Section 22.212 Analysing Vulnerabilities

Question 1

Vulnerability Confirmation

Answer 1

Determining the accuracy of identified potential security weaknesses

Question 2

Vulnerability Confirmation

True Positive

Answer 2

Real and exploitable vulnerability correctly identified

Question 3

Vulnerability Confirmation

False Positive

Answer 3

Incorrectly stated vulnerability

Question 4

Vulnerability Confirmation

True Negative

Answer 4

Correctly identifies the absence of a vulnerability

Question 5

Vulnerability Confirmation

False Negative

Answer 5

Serious finding – vulnerability exists but remains undetected

Question 6

Prioritising Vulnerabilities

Answer 6

■ Ranking identified vulnerabilities by severity and potential impact

■ Factors include ease of exploitation, potential damage, system importance

■ Use scoring systems like Common Vulnerability Scoring System (CVSS)

■ Ensure focus on the most critical security threats

Question 7

Classifying Vulnerabilities

Answer 7

■ Categorizing vulnerabilities based on type, potential impact, and affected systems

■ Streamlines management and response efforts

■ Vulnerabilities might be classified into categories such as…
● Software flaws
● Configuration errors
● Security policy gaps

Question 8

CVE (Common Vulnerabilities and Exposures)

Answer 8

System that provides a standardised way to uniquely identify and
reference known vulnerabilities in software and hardware

● Provides solutions and mitigation strategies

● Help assess security and prioritize vulnerability fixes

Question 9

Organisational Impact of Vulnerabilities

Answer 9

Assessing potential impact on confidentiality, integrity, and availability

■ Consider industry-specific impact

■ Impact on reputation, business continuity, regulatory fines, customer trust

Question 10

Exposure Factor (EF)

Answer 10

A quantifiable metric to estimate the percentage of asset damage

■ Helps understand potential loss due to vulnerability exploitation

■ Supports qualitative risk management in the organisation

Question 11

Risk Tolerance

Answer 11

The level of risk an organization is willing to accept

■ Determines the urgency of vulnerability remediation

■ High risk tolerance may allow monitoring of certain vulnerabilities

■ Low risk tolerance may require swift remediation of even minor vulnerabilities

■ Alignment of vulnerability management with overall business strategies and objectives