// PATH EXAM

📡 Vulnerabilities & threat intel

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. Your package-lock.json has lodash 4.17.11, with a vulnerability fixed in 4.17.21. What do you do? Nothing: it is a third-party dependency Update to 4.17.21 or later and check nothing breaks Downgrade to an older version Delete package-lock.json

2. What is a "0-day"? A CVE published today A patch installed on the same day A vulnerability exploited before a patch exists A flaw with no impact at all

3. Why is sorting by CVSS not enough to decide what to patch first? Because it is random Because CVSS only applies to Windows Because severity does not say whether it is exploited: you need to add exploitation (KEV, EPSS) and exposure Because CVSS is always miscalculated

4. What does the CVSS PR (Privileges Required) metric measure? Whether there is a public exploit How many patches are needed The privileges the attacker needs before exploiting it The privileges the attacker gains afterwards

5. What does CVSS measure? The technical severity of a vulnerability (impact and ease of exploitation), from 0 to 10 What it costs to patch it The probability that it gets exploited in the next 30 days Whether it is already being exploited

6. What is OSV.dev? A port scanner A cloud SIEM A server antivirus An open database of vulnerabilities in open-source packages, with the affected and fixed versions

7. One vulnerability has CVSS 9.8 and no known exploit; another has CVSS 7.5 and is in KEV. Which do you patch first? The 9.8 one: it has the higher score The oldest one Both at once, without prioritising The KEV one: it is already being exploited

8. What is a CVE identifier? A patch number A unique public name for one specific vulnerability (CVE-YYYY-NNNN) A malware family A severity score