CVE Assessment & Patch Management Flashcards
7 cards from real CCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 CVE Assessment & Patch Management flashcards as text
Under the NIST SP 800-40 guidance on patch management, what is the recommended maximum timeframe to patch critical vulnerabilities in internet-facing systems?
Answer: Within days to a few weeks, depending on risk
NIST SP 800-40 recommends patching critical vulnerabilities in exposed systems as quickly as possible, typically within days to weeks, based on assessed risk.
A CVE marked 'DISPUTED' in the NVD indicates:
Answer: At least one party disagrees that the reported issue is a vulnerability or that the details are accurate
A DISPUTED status means there is disagreement between the reporter and vendor (or other parties) about whether the issue constitutes a valid exploitable vulnerability.
Which technique can attackers use to exploit the gap between vulnerability disclosure and patch deployment?
Answer: N-day exploit development targeting the disclosed CVE before patching is complete
After a CVE is disclosed, attackers develop N-day exploits targeting unpatched systems, making rapid patch deployment critical during the exposure window.
What is 'patch diffing' used for in a security context?
Answer: Comparing patched and unpatched binaries to reverse-engineer the underlying vulnerability
Patch diffing is a reverse-engineering technique where attackers or researchers compare pre- and post-patch binaries to identify what changed and reconstruct the exploitable flaw.
In the context of vulnerability management, what is a 'false positive'?
Answer: A scanner reports a vulnerability that does not actually exist on the target system
A false positive occurs when a vulnerability scanner incorrectly identifies a vulnerability on a system where it does not actually exist or is not exploitable in that configuration.
Which component of the Common Platform Enumeration (CPE) naming scheme identifies the specific version of an affected product?
Answer: The version field in the CPE URI, e.g., cpe:/a:vendor:product:version
CPE URIs include a version field that specifies the exact product version affected, enabling precise matching of CVEs to installed software inventories.
When a vendor releases a patch marked 'Defense in Depth' rather than a direct fix, it typically means:
Answer: The patch adds mitigating controls that reduce attack surface without fully eliminating the vulnerability
Defense-in-depth patches add hardening measures (e.g., additional validation, ASLR improvements) that reduce exploitability without resolving the underlying root cause.