Module 2: Data Organization in Vulnerability Response

Question 1

What is the community-developed list of common software security weaknesses which serves as a common language, a measuring stick for software security tools, and as a baseline for weakness identification, mitigation, and prevention efforts?

Answer 1

Common Weakness Enumeration (CWE)

Question 2

Where are common Vulnerabilties and Exposures CVE-ID records downloaded from?

Answer 2

National Vulnerability Database (NVD)

Question 3

When VR matches vulnerabilities with items in your environment, what type of record is created?

Answer 3

Vulnerable Item

Question 4

When scanners pass the data into ServiceNow, what is used to identify the Configuration Item affected by a particular vulnerability?

Answer 4

CI Lookup rules

Question 5

T/F: Vulnerable Items and Remediation Tasks follow the same process flow

Answer 5

True

Question 6

What is the Vulnerable Item table name?

Answer 6

[sn_vul_vulnerable_item]

Question 7

A Vulnerable Item (VIT) is the Vulnerability as it relates to a specific ________________________.

Answer 7

Configuration Item (CI)

Question 8

T/F: A VIT can exist without a specific Configuration Item.

Answer 8

False

Question 9

What are distinct occurrences of vulnerabilities as reported by the scanners of third-party integrations?

Answer 9

Detections

Question 10

What are vulnerabilities on custom software applications scanned throughout the application’s development life cycle?

Answer 10

Application vulnerabilities

Question 11

What three user groups does Application Vulnerability Response use?

Answer 11

App-Sec Manager
Application Security Champion
Developer

Question 12

T/F: ServiceNow’s Application Vulnerability Response application focuses on DAST and SAST.

Answer 12

True

Question 13

What is SAST?

Answer 13

Static Application Security Testing

Question 14

What is DAST?

Answer 14

Dynamic Application Security Testing

Question 15

What is the scanned application table?

Answer 15

[sn_vul_app_scanned_application]

Question 16

How is the Scanned Applications table populated?

Answer 16

From the integrated scanner

Question 17

Where do you go to update a Scanned Application?

Answer 17

Application Vulnerability Response > Administration > Applications

Question 18

What do Scanned Applications often correspond to in the CMDB?

Answer 18

Mapped Application Services

Question 19

Scanned Applications should be mapped to ______________________ in a manner consistent with the Common Service Data Model adopted by the environment.

Answer 19

Technical Services

Question 20

What is the Application Vulnerable Item table?

Answer 20

[sn_vul_app_vulnerable_item]