// PATH EXAM

📡 Vulnerabilities & threat intel

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. What does EPSS measure? The probability that it gets exploited in the next 30 days Its technical severity How long the vendor takes to ship the patch How many machines have it

2. And UI:R? That the user must do something (open a file, click a link) That it is exploited over the network That the integrity impact is high That administrator privileges are needed

3. One vulnerability has CVSS 9.8 and no known exploit; another has CVSS 7.5 and is in KEV. Which do you patch first? Both at once, without prioritising The KEV one: it is already being exploited The 9.8 one: it has the higher score The oldest one

4. What does CVSS measure? Whether it is already being exploited What it costs to patch it The probability that it gets exploited in the next 30 days The technical severity of a vulnerability (impact and ease of exploitation), from 0 to 10

5. What is OSV.dev? An open database of vulnerabilities in open-source packages, with the affected and fixed versions A server antivirus A cloud SIEM A port scanner

6. In a CVSS v3.1 vector, what does AV:N indicate? That the user needs to do something That it can be exploited over the network, remotely That it has no impact That physical access is needed

7. What is the CISA KEV catalog? Microsoft’s monthly patch list A list of vulnerabilities with confirmed active exploitation A standard for scoring vulnerabilities All published CVEs

8. Why is sorting by CVSS not enough to decide what to patch first? Because CVSS is always miscalculated Because it is random Because severity does not say whether it is exploited: you need to add exploitation (KEV, EPSS) and exposure Because CVSS only applies to Windows