# SEAS-8414 Chapter 3 Homework

## Blackboard Multiple-Choice Assessment: Vulnerability Assessment as Cyber Analytics

**Format:** 50 single-correct-answer multiple-choice questions, 2 points each.

**Assessment boundary:** Chapter 3 only. Each item concerns candidate vulnerability records,
CPE precision, NVD/CVE lookup, CVSS vector interpretation, OpenVAS, Nuclei, default-credential
checks, false-positive validation, evidence correlation, or prioritization. Each stem contains the
rule, evidence, threshold, or formula needed to answer without using external material.
All `round(x)` operations in this assessment use round-half-up.
Behavior matches promote a finding to `confirmed` only when the local rule in the stem explicitly
says so; otherwise, keep behavior evidence and validation status as separate fields.
Several items encode an explicit failure mode, validation/proof condition, trade-off, operator
context, and measured or heuristic evidence rule inside the stem.

**Provenance note:** Each item includes a public scenario-provenance label. The label explains the
real-world setting that inspired the item, but the label is not needed to answer the question.

---

### Question 1

**Scenario provenance only (not needed to answer):** NVD public CVE/CPE documentation and Verkada camera incident reporting.

A Chapter 3 cyber-analytics pipeline receives a Chapter 2 IoT camera artifact with CPE candidate `cpe:2.3:a:hikvision:ip_camera:*:*:*:*:*:*:*:*`. The NVD query returns 20 CVEs for that broad family candidate. No active scanner, Nuclei template, or credential check has run.

Which vulnerability state is correct?

(a) Confirmed weakness
(b) Candidate vulnerability set from broad identity evidence
(c) False positive
(d) Remediation completed

### Question 2

**Scenario provenance only (not needed to answer):** NIST CPE Naming and NVD matching behavior.

A camera has two possible CPE candidates. Candidate A is broad: `hikvision:ip_camera:*` and returns 20 CVEs. Candidate B is model/version-specific: `hikvision:ds-2cd2142fwd-i:5.5.82` and returns 4 CVEs. The local precision rule says model/version CPE has higher precision than family wildcard CPE when the model/version evidence is observed.

Which lookup result is used for the primary candidate list?

(a) The broad result because it returns more CVEs
(b) Both lists added together without deduplication
(c) The model/version-specific result as the primary list, with broad result retained as context
(d) No CPE result because the counts differ

### Question 3

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 public specification.

For an IoT DVR, a CVSS v3.1 vector begins `AV:N/AC:L/PR:N/UI:N`. The stem defines `AV:N` as network attack vector, `AC:L` as low attack complexity, `PR:N` as no privileges required, and `UI:N` as no user interaction required. The analytics rule tags a finding `remote-no-touch` only when all four conditions appear together.

Which tag assignment is correct?

(a) Apply `remote-no-touch` because all four required conditions are present
(b) Apply `local-admin` because `PR:N` means administrator required
(c) Apply `physical-only` because `AV:N` means near the device
(d) Apply `user-training` because `UI:N` means user interaction required

### Question 4

**Scenario provenance only (not needed to answer):** NVD API public documentation.

The Chapter 3 NVD adapter attempts an exact `cpeName` query first. If that returns zero records and the CPE contains wildcards, the adapter attempts `virtualMatchString`. An IoT camera CPE has version `*`; exact `cpeName` returns zero.

Which next query follows the adapter rule?

(a) Stop and mark the device patched
(b) Run default credentials
(c) Run OpenVAS with no record of the NVD result
(d) Run `virtualMatchString` for the wildcard CPE

### Question 5

**Scenario provenance only (not needed to answer):** NVD public documentation and IoT asset-management practice.

An OT gateway has an exact CPE. The NVD query returns zero CVEs. The Chapter 3 rule says zero returned CVEs means no NVD records matched that query; it does not prove the device has no weaknesses.

Which statement is supported?

(a) The device is secure
(b) All vulnerabilities are false positives
(c) No NVD CVE matched the exact query; absence of weakness is not proven
(d) Default credentials failed

### Question 6

**Scenario provenance only (not needed to answer):** Greenbone/OpenVAS public documentation.

An OpenVAS scan against an IoT camera reports a network finding: `service=HTTP`, `oid=1.3.6.1.4.1...`, severity `7.5`, evidence `banner matched`. The Chapter 3 evidence taxonomy classifies OpenVAS as active scanner evidence.

Which evidence class is correct?

(a) Active scanner evidence
(b) Chapter 2 identity evidence only
(c) Remediation proof
(d) Passive host discovery only

### Question 7

**Scenario provenance only (not needed to answer):** Nuclei public template documentation.

A Nuclei template sends an HTTP request to `/system/deviceInfo` on a lab Hikvision camera simulator. The response contains the exact matcher string defined in the template, and Nuclei records a match. Chapter 3 treats template matches as behavior-based evidence tied to the template logic.

Which state is correct?

(a) No evidence because Nuclei is not a scanner
(b) Template-based vulnerability evidence for the matched behavior
(c) CPE construction evidence only
(d) Firmware update completed

### Question 8

**Scenario provenance only (not needed to answer):** CISA/NSA public guidance on default credentials.

A default-credential checker for an IoT DVR tries `admin:wrong` and receives HTTP `401`. It then tries `admin:12345` and receives HTTP `200` plus an authenticated device page. The checker rule requires one negative control and one authenticated success for a positive result.

Which result follows?

(a) No result because one login failed
(b) False positive because HTTP was used
(c) Candidate only because credentials are never direct evidence
(d) Confirmed default-credential weakness

### Question 9

**Scenario provenance only (not needed to answer):** Public vulnerability-validation workflows.

A validation table for OT cameras suppresses false positives by the exact pair `(cve_id, device_ip)`. It contains `(CVE-2017-7921, 10.0.0.5)`. A scan reports `CVE-2017-7921` for `10.0.0.6`.

Which suppression decision is correct?

(a) Suppress because the CVE ID matches
(b) Suppress because both hosts are cameras
(c) Do not suppress; the device IP differs
(d) Suppress every CVE on the subnet

### Question 10

**Scenario provenance only (not needed to answer):** Vendor backporting patterns in public vulnerability-management discussions.

An OT camera banner says firmware `5.5.82`. The vendor advisory says firmware `5.5.82-build9` includes a backported patch. The device reports build `5.5.82-build9`. The local rule says exact observed patched build evidence overrides a banner-only candidate.

Which state follows?

(a) Candidate is marked false positive for this device/build
(b) Confirmed weakness remains because base version matches
(c) Default credentials are confirmed
(d) CPE evidence is deleted

### Question 11

**Scenario provenance only (not needed to answer):** Public CPE ambiguity in IoT vulnerability assessment.

A device has two unresolved CPE candidates: one for an Axis camera and one for a Dahua camera. The rule says NVD results from unresolved conflicting CPEs remain separate candidate sets and cannot be merged into a single confirmed weakness.

Which result is correct?

(a) Merge both CVE lists into confirmed weaknesses
(b) Choose the longer list automatically
(c) Delete both candidates
(d) Preserve separate candidate sets with conflict provenance

### Question 12

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 public specification.

The stem defines CVSS `C:H/I:H/A:H` as high confidentiality, integrity, and availability impact. An IoT camera triage rule adds 3 impact points for each high impact metric and 0 points otherwise. A vulnerability vector ends with `C:H/I:H/A:H`.

Which impact-score interpretation is correct?

(a) 0 impact points because high values are informational only
(b) 9 impact points across confidentiality, integrity, and availability
(c) 3 impact points for availability only
(d) A physical-safety score unrelated to CVSS impact

### Question 13

**Scenario provenance only (not needed to answer):** Public risk-prioritization methods for OT environments.

A Chapter 3 priority formula is defined as `priority = severity_points + evidence_points + exposure_points + consequence_points`. A camera candidate has severity `7`, Nuclei match evidence `3`, internal-only exposure `1`, and safety consequence `2`.

Which priority value is correct?

(a) `10`
(b) `11`
(c) `13`
(d) `21`

### Question 14

**Scenario provenance only (not needed to answer):** NVD, OpenVAS, Nuclei, and default-credential public tooling.

The local evidence ladder uses these categories: `CPE/NVD candidate`, `active scanner finding`, `template behavior match`, and `direct authentication success`. A device has only an NVD result from a broad CPE.

Which evidence category applies?

(a) CPE/NVD candidate
(b) Direct authentication success
(c) Template behavior match
(d) Remediation proof

### Question 15

**Scenario provenance only (not needed to answer):** Operational scanning constraints in public industrial-control guidance.

An OT controller is in a maintenance-free production window. The site policy blocks active vulnerability scanning but permits passive use of existing Chapter 2 identity records and NVD lookup. Chapter 3 records method status separately from vulnerability state.

Which method-status record is correct?

(a) OpenVAS complete
(b) Default credentials succeeded
(c) Nuclei matched
(d) Active scanner skipped by policy; passive/NVD assessment allowed

### Question 16

**Scenario provenance only (not needed to answer):** Public default-credential assessment controls.

A default-credential module is disabled by authorization policy for a hospital infusion pump. No credential attempt occurs. The method-status rule distinguishes `not_run` from `negative`.

Which result is correct?

(a) Default credentials failed
(b) Default-credential method `not_run`; no credential evidence collected
(c) Default credentials succeeded
(d) CVE suppressed

### Question 17

**Scenario provenance only (not needed to answer):** NVD API rate-limit management.

An NVD batch for IoT devices contains 150 device CPE strings, but only 90 are unique after deduplication. The rate discipline says one NVD request is sent per unique CPE.

How many NVD requests are sent?

(a) `60`
(b) `150`
(c) `90`
(d) `240`

### Question 18

**Scenario provenance only (not needed to answer):** Public OT vulnerability triage reports.

Two IoT devices have these records. Device A has 12 NVD candidates from a broad CPE and no active evidence. Device B has 1 default-credential success and no NVD candidates. The local rule ranks direct authentication success above candidate count.

Which device receives higher evidence rank?

(a) Device B
(b) Device A
(c) Both equal because counts differ
(d) Neither device has evidence

### Question 19

**Scenario provenance only (not needed to answer):** Public web-authentication testing guardrails.

A credential checker for an IoT camera sends one unauthenticated request to `/admin` and receives HTTP `200` with a public login page. It sends `admin:admin` and receives HTTP `200` with the same body. The guardrail says success requires authenticated-only content or a session change compared with the negative control.

Which result follows?

(a) Confirmed default credential
(b) Confirmed CVE
(c) Negative credential result under the stated guardrail
(d) NVD match

### Question 20

**Scenario provenance only (not needed to answer):** Nuclei public template execution behavior.

A Nuclei run against an IoT camera executes zero templates because the selected template directory is empty. The Chapter 3 method-status rule distinguishes `complete_no_findings` from `not_executed`.

Which status is correct?

(a) Complete no findings
(b) Not executed for vulnerability coverage because no templates ran
(c) Confirmed safe
(d) False positive

### Question 21

**Scenario provenance only (not needed to answer):** Greenbone/OpenVAS public scan-result examples.

OpenVAS reports an informational finding on an OT printer: `TCP timestamps detected`, severity `0.0`, no CVE. The local rule records informational scanner output but does not convert severity `0.0` informational items into vulnerability candidates.

Which state is correct?

(a) Confirmed weakness
(b) Remediation item
(c) Informational scanner evidence only
(d) Default-credential result

### Question 22

**Scenario provenance only (not needed to answer):** Public camera information-disclosure advisories.

An unauthenticated HTTP request to `/system/deviceInfo` on an IoT camera returns model, firmware, and MAC address. The template rule for the lab says this response pattern creates behavior evidence for the information-disclosure template; final validation status is tracked separately.

Which state follows?

(a) Behavior evidence for the template, with validation status tracked separately
(b) No evidence because no exploit payload was used
(c) CPE construction only
(d) False positive because the response is XML

### Question 23

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 public specification.

The stem defines `PR:N` as no privileges required and `PR:L` as low privileges required. An IoT gateway CVSS vector contains `PR:N`. The scanner rule adds a `preauth` tag only when no privileges are required.

Which scanner tag follows?

(a) `admin-required`
(b) `local-user-required`
(c) `preauth`
(d) `physical-access-required`

### Question 24

**Scenario provenance only (not needed to answer):** Public vulnerability-validation table workflows.

A validation record contains fields `cve_id=CVE-2020-0001`, `device_ip=10.0.8.9`, `status=false_positive`, and `evidence=patched build observed`. The scan reports the same CVE and device IP again.

Which action follows?

(a) Promote to confirmed weakness
(b) Suppress as false positive for that CVE/device pair
(c) Suppress all findings from the scanner
(d) Delete the CPE candidate

### Question 25

**Scenario provenance only (not needed to answer):** Public CVE correlation workflows.

NVD and OpenVAS both report `CVE-2021-1234` for the same IoT gateway. The correlation rule says identical `cve_id` on the same device becomes one vulnerability record with multiple evidence sources.

How many vulnerability records are created for that CVE on that device?

(a) `0`
(b) `2`
(c) `1`
(d) `3`

### Question 26

**Scenario provenance only (not needed to answer):** Public OT prioritization scorecards.

An evidence score rule assigns `1` for NVD-only candidate, `2` for OpenVAS finding, `3` for Nuclei behavior match, and `4` for default-credential success. A device has NVD, OpenVAS, and Nuclei evidence for the same CVE. The rule uses the maximum evidence score for that CVE/device pair.

Which evidence score is used?

(a) `3`
(b) `1`
(c) `2`
(d) `6`

### Question 27

**Scenario provenance only (not needed to answer):** NIST CPE Naming and NVD matching behavior.

An IoT family CPE with version wildcard returns 30 CVEs. A model/version exact CPE returns 6 CVEs. The recall/precision rule says broad wildcard CPEs have higher recall and lower precision; exact model/version CPEs have lower recall and higher precision.

Which description is correct?

(a) The broad query has lower recall and higher precision
(b) The exact query has higher recall and lower precision
(c) Both queries have identical recall and precision
(d) The broad query has higher recall and lower precision

### Question 28

**Scenario provenance only (not needed to answer):** Public camera vulnerability-management practice.

A Chapter 2 artifact contains vendor `Axis`, model `P1375`, firmware `10.12.2`, and observed ONVIF source. NVD has a matching CPE for exactly that model and version. The Chapter 3 CPE rule classifies this as high-precision identity input.

Which CPE classification applies?

(a) Family wildcard
(b) Exact model/version
(c) Host-discovery-only
(d) Default-credential evidence

### Question 29

**Scenario provenance only (not needed to answer):** Public firmware-inventory limitations.

An IoT camera artifact has vendor and model evidence but no firmware version. NVD contains version-specific CVE criteria. The rule says missing version evidence forces either wildcard query or unresolved applicability, not exact version matching.

Which state is correct?

(a) Exact version applicability confirmed
(b) No vulnerability assessment allowed
(c) Wildcard or unresolved version applicability recorded
(d) Default credentials confirmed

### Question 30

**Scenario provenance only (not needed to answer):** NVD API caching and rate-discipline public guidance.

The local cache rule says use cached NVD results when cache age is less than or equal to 24 hours. A cached result for an IoT gateway CPE is 18 hours old.

Which action follows?

(a) Use the cached result
(b) Delete the result
(c) Run OpenVAS instead of using NVD
(d) Mark the device safe

### Question 31

**Scenario provenance only (not needed to answer):** Public vulnerability-management stage design.

A Chapter 3 record contains `device_id`, `cve_id`, `source=NVD`, `evidence=CPE match`, `status=candidate`, and no scanner or credential corroboration. The status rule says CPE match alone is a candidate.

Which classification is correct?

(a) Confirmed weakness
(b) False positive
(c) Remediation completed
(d) Candidate vulnerability

### Question 32

**Scenario provenance only (not needed to answer):** Public OT remediation prioritization workflows.

A remediation item rule requires a vulnerability record plus priority inputs: severity, evidence strength, exposure, role, and consequence. A record has CVE ID and severity only.

Which state is correct?

(a) Fully prioritized remediation item
(b) Vulnerability record missing priority inputs
(c) False positive
(d) Chapter 2 identity artifact only

### Question 33

**Scenario provenance only (not needed to answer):** Public industrial safety consequence assessment.

Priority formula: `priority = severity + evidence + exposure + consequence`. Two devices have equal severity `8`, evidence `3`, and exposure `2`. Device A is a lobby camera with consequence `1`; Device B is a pump controller with consequence `4`.

Which priority comparison is correct?

(a) Device A has higher priority
(b) Equal priority
(c) Device B has higher priority by `3` points
(d) Device B has lower priority by `3` points

### Question 34

**Scenario provenance only (not needed to answer):** FDA and CISA medical-device cybersecurity public guidance.

A hospital infusion pump has severity `6.5`, direct network exposure `0`, evidence score `1`, and patient-care consequence `5`. The local formula is `priority = round(severity) + exposure + evidence + consequence`.

Which priority is correct?

(a) `13`
(b) `6.5`
(c) `7`
(d) `12`

### Question 35

**Scenario provenance only (not needed to answer):** Public false-positive validation in vulnerability scanners.

A false-positive table contains `(CVE-2022-2222, 10.4.1.7)`. The same CVE appears on `10.4.1.7` and on `10.4.1.8`. Suppression is exact by `(cve_id, device_ip)`.

Which pair is suppressed?

(a) Both device records
(b) Neither device record
(c) Only `10.4.1.8`
(d) Only `10.4.1.7`

### Question 36

**Scenario provenance only (not needed to answer):** Public vendor advisory version criteria.

A CVE applies to firmware versions `< 2.0.0`. An IoT gateway reports firmware `2.1.0` from an authenticated management API. The Chapter 3 version rule says observed versions outside affected criteria do not create an applicable candidate for that CVE.

Which state follows?

(a) Applicable candidate
(b) Not applicable by observed version criteria
(c) Confirmed weakness
(d) Default credentials succeeded

### Question 37

**Scenario provenance only (not needed to answer):** Public OT risk-score calculation.

Priority formula: `priority = round(CVSS) + evidence + exposure + consequence`. Device A has CVSS `9.8`, evidence `1`, exposure `0`, consequence `1`. Device B has CVSS `6.5`, evidence `3`, exposure `3`, consequence `4`.

Which priority comparison is correct?

(a) Device A: `12`, Device B: `17`; Device B ranks higher
(b) Device A: `10`, Device B: `7`; Device A ranks higher
(c) Device A: `9.8`, Device B: `6.5`; Device A ranks higher
(d) Both rank equal

### Question 38

**Scenario provenance only (not needed to answer):** Greenbone/OpenVAS public scan-status behavior.

An OpenVAS job against an OT HMI terminates before scanning any host because credentials to the scanner appliance fail. Method status values are `complete`, `failed`, `skipped`, and `not_applicable`.

Which method status is correct?

(a) Failed
(b) Complete
(c) Skipped by policy
(d) Not applicable

### Question 39

**Scenario provenance only (not needed to answer):** Nuclei public template-matcher behavior.

A Nuclei template has two required matchers: status `200` and body string `deviceInfo`. The IoT camera returns status `200` but body lacks `deviceInfo`. The template condition is `all`.

Which result follows?

(a) Match
(b) Confirmed weakness
(c) Default credential success
(d) No match

### Question 40

**Scenario provenance only (not needed to answer):** Public authentication probe guardrails.

A credential checker for an IoT camera sends wrong password and receives `401`; sends candidate password and receives `302` to `/dashboard` with a session cookie. The rule treats negative-control failure plus session-bearing success as direct authentication evidence.

Which result is correct?

(a) No evidence
(b) Confirmed default-credential weakness
(c) NVD candidate only
(d) False positive

### Question 41

**Scenario provenance only (not needed to answer):** Public cyber-analytics evidence correlation.

A vulnerability record for an IoT camera has NVD candidate evidence and Nuclei behavior evidence for the same CVE/device pair. The correlation rule stores one record and two evidence sources, then sets status to confirmed when behavior evidence exists.

Which status and source count are correct?

(a) Candidate, one source
(b) False positive, zero sources
(c) Confirmed, two sources
(d) Remediated, two sources

### Question 42

**Scenario provenance only (not needed to answer):** Public scan-safety exception handling in hospitals.

A hospital policy forbids default-credential attempts on infusion pumps but permits NVD lookup. The method-status record says default-credential check `skipped_by_policy`.

Which vulnerability statement is supported?

(a) No credential evidence was collected because the method was skipped by policy
(b) Default credentials failed
(c) Default credentials succeeded
(d) Every CVE is false positive

### Question 43

**Scenario provenance only (not needed to answer):** Public vulnerability-report deduplication.

A report has these rows for one IoT gateway: `CVE-1` from NVD, `CVE-1` from OpenVAS, `CVE-2` from NVD, `CVE-2` from Nuclei, `CVE-2` from OpenVAS. Deduplication key is `(device, cve_id)`.

How many vulnerability records remain?

(a) `1`
(b) `3`
(c) `5`
(d) `2`

### Question 44

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 public specification.

The stem defines `S:U` as unchanged scope and `S:C` as changed scope. A vector for an OT controller contains `S:U`. The correlation rule sets `cross_authority=true` only for changed scope.

Which correlation field is correct?

(a) `cross_authority=true`
(b) `cross_authority=false`
(c) `physical_isolation=true`
(d) `scanner_credentials_changed=true`

### Question 45

**Scenario provenance only (not needed to answer):** Public OT vulnerability exception records.

A scanner reports a CVE for a PLC. A validation analyst records `status=accepted_risk`, `expires=2026-06-30`, and `reason=scan unsafe until outage`. The reporting rule says accepted risk is neither false positive nor remediation completed.

Which status category is correct?

(a) False positive
(b) Remediated
(c) Accepted risk with expiration
(d) Confirmed credential weakness

### Question 46

**Scenario provenance only (not needed to answer):** Public CVSS and exposure triage practice.

An IoT door controller has CVSS `8.0`, evidence score `4` from default credentials, exposure score `3` because reachable from a vendor VPN, and consequence score `3`. Formula: `priority = round(CVSS) + evidence + exposure + consequence`.

Which priority is correct?

(a) `18`
(b) `15`
(c) `12`
(d) `8`

### Question 47

**Scenario provenance only (not needed to answer):** Public vulnerability-report lineage controls.

A vulnerability record for an IoT camera contains CVE ID and priority score but no source fields. The source contract requires at least one evidence source with method, observed value, timestamp, and status.

Which defect exists?

(a) CVE ID present
(b) Priority score present
(c) Device type missing from the stem
(d) Evidence-source lineage missing

### Question 48

**Scenario provenance only (not needed to answer):** Public OT scanner-result reconciliation.

OpenVAS reports `CVE-9` on a camera. NVD lookup for the exact model/version returns no `CVE-9`, and a Nuclei template for `CVE-9` does not match. The local rule says conflicting evidence keeps the OpenVAS finding as scanner evidence but prevents automatic confirmation.

Which state follows?

(a) Confirmed weakness automatically
(b) Scanner finding requiring validation
(c) False positive automatically for all devices
(d) Chapter 2 identity only

### Question 49

**Scenario provenance only (not needed to answer):** Public camera exposure prioritization.

Two cameras have the same CVE, same CVSS, and same evidence score. Camera A is isolated on a lab VLAN with exposure `0`; Camera B is reachable through a remote-access gateway with exposure `3`. Formula uses exposure as an additive term.

Which priority comparison is correct?

(a) Camera A higher by `3`
(b) Equal priority
(c) Camera B higher by `3`
(d) Camera B lower by `3`

### Question 50

**Scenario provenance only (not needed to answer):** Public cyber-analytics stage-gating for IoT/OT platforms.

A Chapter 3 output record includes device identity, candidate/confirmed vulnerability status, evidence sources, validation status, priority fields, and residual uncertainty. It does not include exploitation steps or attack-chain modeling.

Which stage boundary classification is correct?

(a) Chapter 3 vulnerability-assessment output
(b) Chapter 2 service-enrichment output only
(c) Chapter 4 exploit-chain output
(d) Chapter 1 discovery-only output
