# SEAS-8414 Phase 4 Homework
## Blackboard Multiple-Choice Assessment: Attack Graph Analytics and Risk Scoring

**Due:** Before Class 5, 9:00 AM ET
**Total Points:** 100
**Format:** 50 single-correct-answer multiple choice questions, 2 points each
**Audience:** Doctoral students and senior cybersecurity practitioners

This assessment is designed for Blackboard delivery. Every item is multiple choice
with exactly one correct answer. The assessment is closed book: do not use the
textbook, notes, internet search, lab files, scanners, AI tools, or outside
incident writeups while answering.

Each question includes a scenario-provenance label. That label is a citation
trail for instructors and is never required to choose the answer. Every formula,
threshold, rule, or evidence contract required to answer appears inside the stem.

Chapter boundary: answer only within predictive cyber analytics for IoT/OT platforms. Do not import later
chapter capabilities unless the stem explicitly defines them.

---

### Question 1

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility scores one IoT/OT device with the Chapter 4 BRS formula `BRS = 0.20*V +
0.20*E + 0.20*R + 0.15*P + 0.05*S - 0.20*C`, clamped to 0-10. The component values are
V=8.0, E=10.0, R=9.0, P=10.0, S=2.0, C=1.0. Which BRS value is the correct arithmetic
result before any rating label is assigned?

(a) 6.80
(b) 7.20
(c) 5.30
(d) 7.00

### Question 2

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

A power cooperative scores one IoT/OT device with the Chapter 4 BRS formula `BRS =
0.20*V + 0.20*E + 0.20*R + 0.15*P + 0.05*S - 0.20*C`, clamped to 0-10. The component
values are V=6.5, E=9.0, R=7.5, P=8.0, S=0.0, C=4.0. Which BRS value is the correct
arithmetic result before any rating label is assigned?

(a) 6.60
(b) 3.80
(c) 5.80
(d) 5.00

### Question 3

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A pipeline operator scores one IoT/OT device with the Chapter 4 BRS formula `BRS =
0.20*V + 0.20*E + 0.20*R + 0.15*P + 0.05*S - 0.20*C`, clamped to 0-10. The component
values are V=9.8, E=6.0, R=0.0, P=6.0, S=3.0, C=5.0. Which BRS value is the correct
arithmetic result before any rating label is assigned?

(a) 2.31
(b) 4.21
(c) 3.21
(d) 5.21

### Question 4

**Scenario provenance only (not needed to answer):** OASIS STIX 2.1 standard.

A maritime port authority scores one IoT/OT device with the Chapter 4 BRS formula `BRS =
0.20*V + 0.20*E + 0.20*R + 0.15*P + 0.05*S - 0.20*C`, clamped to 0-10. The component
values are V=5.4, E=10.0, R=9.2, P=10.0, S=1.0, C=2.0. Which BRS value is the correct
arithmetic result before any rating label is assigned?

(a) 6.47
(b) 6.07
(c) 6.87
(d) 4.57

### Question 5

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 specification.

A hospital medical-device program scores one IoT/OT device with the Chapter 4 BRS
formula `BRS = 0.20*V + 0.20*E + 0.20*R + 0.15*P + 0.05*S - 0.20*C`, clamped to 0-10.
The component values are V=7.5, E=8.0, R=6.8, P=9.0, S=2.0, C=3.0. Which BRS value is
the correct arithmetic result before any rating label is assigned?

(a) 5.31
(b) 6.51
(c) 3.96
(d) 5.91

### Question 6

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

A power cooperative attack graph uses Chapter 4 path probability `P = 1 / (1 +
total_weight)`. The path has 2 hops with edge weights 0.5, 0.1. The local critical-path
rule is: at most 3 hops and total weight below 2.0. Which path statement is correct?

(a) Total weight 0.6, probability 0.37, critical path.
(b) Total weight 1.6, probability 0.38, critical path.
(c) Total weight 0.6, probability 0.62, not a critical path.
(d) Total weight 0.6, probability 0.62, critical path.

### Question 7

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A pipeline operator attack graph uses Chapter 4 path probability `P = 1 / (1 +
total_weight)`. The path has 3 hops with edge weights 1.0, 0.5, 0.2. The local
critical-path rule is: at most 3 hops and total weight below 2.0. Which path statement
is correct?

(a) Total weight 2.7, probability 0.27, critical path.
(b) Total weight 1.7, probability 0.37, not a critical path.
(c) Total weight 1.7, probability 0.37, critical path.
(d) Total weight 1.7, probability 0.63, critical path.

### Question 8

**Scenario provenance only (not needed to answer):** OASIS STIX 2.1 standard.

A maritime port authority attack graph uses Chapter 4 path probability `P = 1 / (1 +
total_weight)`. The path has 4 hops with edge weights 0.7, 0.7, 0.5, 0.1. The local
critical-path rule is: at most 3 hops and total weight below 2.0. Which path statement
is correct?

(a) Total weight 2.0, probability 0.33, critical path.
(b) Total weight 2.0, probability 0.33, not a critical path.
(c) Total weight 2.0, probability 0.67, not a critical path.
(d) Total weight 3.0, probability 0.25, not a critical path.

### Question 9

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 specification.

A hospital medical-device program attack graph uses Chapter 4 path probability `P = 1 /
(1 + total_weight)`. The path has 3 hops with edge weights 0.2, 0.1, 0.8. The local
critical-path rule is: at most 3 hops and total weight below 2.0. Which path statement
is correct?

(a) Total weight 1.1, probability 0.48, critical path.
(b) Total weight 1.1, probability 0.52, critical path.
(c) Total weight 2.1, probability 0.32, critical path.
(d) Total weight 1.1, probability 0.48, not a critical path.

### Question 10

**Scenario provenance only (not needed to answer):** Yen 1971 k-shortest loopless paths paper.

A rail signaling operator attack graph uses Chapter 4 path probability `P = 1 / (1 +
total_weight)`. The path has 3 hops with edge weights 1.0, 1.0, 0.7. The local
critical-path rule is: at most 3 hops and total weight below 2.0. Which path statement
is correct?

(a) Total weight 2.7, probability 0.73, not a critical path.
(b) Total weight 3.7, probability 0.21, not a critical path.
(c) Total weight 2.7, probability 0.27, critical path.
(d) Total weight 2.7, probability 0.27, not a critical path.

### Question 11

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A pipeline operator computes the Chapter 4 segmentation score with `10.0 * (1.0 -
cross_subnet_edges / total_device_edges)`. The graph has 45 cross-subnet device edges
and 180 total device-to-device edges. The score is a topology signal, not proof that
firewall policy is enforced. Which result is correct?

(a) Segmentation score 7.50; treat it as proof that firewall rules block unauthorized traffic.
(b) Segmentation score 13.50; subtract cross-subnet edges from total edges.
(c) Segmentation score 7.50; use it as a topology signal, not policy proof.
(d) Segmentation score 2.50; higher cross-subnet edge share means stronger segmentation.

### Question 12

**Scenario provenance only (not needed to answer):** OASIS STIX 2.1 standard.

A maritime port authority computes the Chapter 4 segmentation score with `10.0 * (1.0 -
cross_subnet_edges / total_device_edges)`. The graph has 18 cross-subnet device edges
and 120 total device-to-device edges. The score is a topology signal, not proof that
firewall policy is enforced. Which result is correct?

(a) Segmentation score 10.20; subtract cross-subnet edges from total edges.
(b) Segmentation score 8.50; use it as a topology signal, not policy proof.
(c) Segmentation score 1.50; higher cross-subnet edge share means stronger segmentation.
(d) Segmentation score 8.50; treat it as proof that firewall rules block unauthorized traffic.

### Question 13

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 specification.

A hospital medical-device program computes the Chapter 4 segmentation score with `10.0 *
(1.0 - cross_subnet_edges / total_device_edges)`. The graph has 0 cross-subnet device
edges and 75 total device-to-device edges. The score is a topology signal, not proof
that firewall policy is enforced. Which result is correct?

(a) Segmentation score 10.00; use it as a topology signal, not policy proof.
(b) Segmentation score 0.00; higher cross-subnet edge share means stronger segmentation.
(c) Segmentation score 10.00; treat it as proof that firewall rules block unauthorized traffic.
(d) Segmentation score 7.50; subtract cross-subnet edges from total edges.

### Question 14

**Scenario provenance only (not needed to answer):** Yen 1971 k-shortest loopless paths paper.

A rail signaling operator computes the Chapter 4 segmentation score with `10.0 * (1.0 -
cross_subnet_edges / total_device_edges)`. The graph has 33 cross-subnet device edges
and 110 total device-to-device edges. The score is a topology signal, not proof that
firewall policy is enforced. Which result is correct?

(a) Segmentation score 3.00; higher cross-subnet edge share means stronger segmentation.
(b) Segmentation score 7.00; treat it as proof that firewall rules block unauthorized traffic.
(c) Segmentation score 7.70; subtract cross-subnet edges from total edges.
(d) Segmentation score 7.00; use it as a topology signal, not policy proof.

### Question 15

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A food processing plant computes the Chapter 4 segmentation score with `10.0 * (1.0 -
cross_subnet_edges / total_device_edges)`. The graph has 84 cross-subnet device edges
and 210 total device-to-device edges. The score is a topology signal, not proof that
firewall policy is enforced. Which result is correct?

(a) Segmentation score 6.00; treat it as proof that firewall rules block unauthorized traffic.
(b) Segmentation score 12.60; subtract cross-subnet edges from total edges.
(c) Segmentation score 6.00; use it as a topology signal, not policy proof.
(d) Segmentation score 4.00; higher cross-subnet edge share means stronger segmentation.

### Question 16

**Scenario provenance only (not needed to answer):** OASIS STIX 2.1 standard.

In a maritime port authority, Chapter 4 edge weights are attacker-effort weights: lower
means easier traversal. The local table includes shares_credentials=0.1, critical
exploit=0.2, known exploit=0.3, same_firmware=0.4, same_subnet=0.5, service_exposed=0.7,
controls_process=0.8, and L3_routed=1.0. The relationship is: two cameras share known
default credentials. Which edge interpretation is correct?

(a) Use CVSS as the edge weight because every graph edge must inherit vulnerability severity.
(b) Use `shares_credentials` with weight 0.1; a single login attempt is the easiest lateral move.
(c) Use the highest available weight because important assets should always be harder edges.
(d) Use weight 0.0 because observed relationships have already been proven exploitable.

### Question 17

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 specification.

In a hospital medical-device program, Chapter 4 edge weights are attacker-effort
weights: lower means easier traversal. The local table includes shares_credentials=0.1,
critical exploit=0.2, known exploit=0.3, same_firmware=0.4, same_subnet=0.5,
service_exposed=0.7, controls_process=0.8, and L3_routed=1.0. The relationship is: an
HMI and PLC are on the same /24 broadcast domain. Which edge interpretation is correct?

(a) Use `same_subnet` with weight 0.5; L2 adjacency enables local pivoting but is harder than credential reuse.
(b) Use the highest available weight because important assets should always be harder edges.
(c) Use weight 0.0 because observed relationships have already been proven exploitable.
(d) Use CVSS as the edge weight because every graph edge must inherit vulnerability severity.

### Question 18

**Scenario provenance only (not needed to answer):** Yen 1971 k-shortest loopless paths paper.

In a rail signaling operator, Chapter 4 edge weights are attacker-effort weights: lower
means easier traversal. The local table includes shares_credentials=0.1, critical
exploit=0.2, known exploit=0.3, same_firmware=0.4, same_subnet=0.5, service_exposed=0.7,
controls_process=0.8, and L3_routed=1.0. The relationship is: a service has a public
critical exploit. Which edge interpretation is correct?

(a) Use the highest available weight because important assets should always be harder edges.
(b) Use weight 0.0 because observed relationships have already been proven exploitable.
(c) Use CVSS as the edge weight because every graph edge must inherit vulnerability severity.
(d) Use `critical exploit edge` with weight 0.2; the exploit is easy but still requires executing a module.

### Question 19

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

In a food processing plant, Chapter 4 edge weights are attacker-effort weights: lower
means easier traversal. The local table includes shares_credentials=0.1, critical
exploit=0.2, known exploit=0.3, same_firmware=0.4, same_subnet=0.5, service_exposed=0.7,
controls_process=0.8, and L3_routed=1.0. The relationship is: a device controls a
physical process. Which edge interpretation is correct?

(a) Use weight 0.0 because observed relationships have already been proven exploitable.
(b) Use CVSS as the edge weight because every graph edge must inherit vulnerability severity.
(c) Use `controls_process` with weight 0.8; the edge marks high consequence rather than easy compromise.
(d) Use the highest available weight because important assets should always be harder edges.

### Question 20

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

In a chemical manufacturing site, Chapter 4 edge weights are attacker-effort weights:
lower means easier traversal. The local table includes shares_credentials=0.1, critical
exploit=0.2, known exploit=0.3, same_firmware=0.4, same_subnet=0.5, service_exposed=0.7,
controls_process=0.8, and L3_routed=1.0. The relationship is: traffic must cross a
routed L3 boundary. Which edge interpretation is correct?

(a) Use CVSS as the edge weight because every graph edge must inherit vulnerability severity.
(b) Use `L3 routed edge` with weight 1.0; routing and firewall boundaries make traversal harder.
(c) Use the highest available weight because important assets should always be harder edges.
(d) Use weight 0.0 because observed relationships have already been proven exploitable.

### Question 21

**Scenario provenance only (not needed to answer):** FIRST CVSS v3.1 specification.

A hospital medical-device program compares two devices with the same Chapter 4 BRS
formula. Device A has (V,E,R,P,S,C)=(9.8, 6.0, 0.0, 6.0, 0.0, 4.0). Device B, a PLC, has
(6.5, 10.0, 9.2, 10.0, 0.0, 0.0). Which prioritization statement follows from the
arithmetic?

(a) Device B ranks higher by BRS: Device A=3.26, Device B=6.64.
(b) Device A must rank higher because its V value is larger.
(c) Both devices are tied because C cancels all topology and consequence terms.
(d) The device with the lower CVSS must be excluded from predictive analytics.

### Question 22

**Scenario provenance only (not needed to answer):** Yen 1971 k-shortest loopless paths paper.

A rail signaling operator compares two devices with the same Chapter 4 BRS formula.
Device A has (V,E,R,P,S,C)=(8.8, 6.0, 1.0, 0.0, 0.0, 5.0). Device B, a HMI, has (7.0,
9.0, 8.4, 8.0, 1.0, 1.0). Which prioritization statement follows from the arithmetic?

(a) Device A must rank higher because its V value is larger.
(b) Both devices are tied because C cancels all topology and consequence terms.
(c) The device with the lower CVSS must be excluded from predictive analytics.
(d) Device B ranks higher by BRS: Device A=2.16, Device B=5.93.

### Question 23

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A food processing plant compares two devices with the same Chapter 4 BRS formula. Device
A has (V,E,R,P,S,C)=(9.5, 7.0, 0.0, 4.0, 2.0, 6.0). Device B, a controller, has (5.8,
10.0, 10.0, 9.0, 0.0, 0.0). Which prioritization statement follows from the arithmetic?

(a) Both devices are tied because C cancels all topology and consequence terms.
(b) The device with the lower CVSS must be excluded from predictive analytics.
(c) Device B ranks higher by BRS: Device A=2.80, Device B=6.51.
(d) Device A must rank higher because its V value is larger.

### Question 24

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site compares two devices with the same Chapter 4 BRS formula.
Device A has (V,E,R,P,S,C)=(9.0, 8.0, 2.0, 0.0, 1.0, 5.0). Device B, a SCADA node, has
(6.2, 9.0, 7.6, 10.0, 0.0, 1.0). Which prioritization statement follows from the
arithmetic?

(a) The device with the lower CVSS must be excluded from predictive analytics.
(b) Device B ranks higher by BRS: Device A=2.85, Device B=5.86.
(c) Device A must rank higher because its V value is larger.
(d) Both devices are tied because C cancels all topology and consequence terms.

### Question 25

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator compares two devices with the same Chapter 4 BRS formula.
Device A has (V,E,R,P,S,C)=(8.4, 6.0, 0.0, 6.0, 0.0, 3.0). Device B, a access
controller, has (6.0, 10.0, 9.2, 8.0, 0.0, 0.0). Which prioritization statement follows
from the arithmetic?

(a) Device B ranks higher by BRS: Device A=3.18, Device B=6.24.
(b) Device A must rank higher because its V value is larger.
(c) Both devices are tied because C cancels all topology and consequence terms.
(d) The device with the lower CVSS must be excluded from predictive analytics.

### Question 26

**Scenario provenance only (not needed to answer):** Yen 1971 k-shortest loopless paths paper.

A rail signaling operator maps scan evidence to MITRE ATT&CK for ICS. The Chapter 4
confidence rules are: direct finding-type evidence = 0.8 to 1.0, CWE-based CVE mapping =
0.7, and device-type-only mapping = 0.5. If multiple mappings point to the same
technique, retain provenance and use the highest confidence. The available evidence is
directly observed default credentials. Which mapping confidence is correct?

(a) 0.5, because every ICS technique starts as a device-type assumption.
(b) 0.7, because every MITRE mapping must pass through a CWE.
(c) 1.0, because all ATT&CK mappings are exact once a technique ID is assigned.
(d) 1.0, because this is a finding-type mapping.

### Question 27

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A food processing plant maps scan evidence to MITRE ATT&CK for ICS. The Chapter 4
confidence rules are: direct finding-type evidence = 0.8 to 1.0, CWE-based CVE mapping =
0.7, and device-type-only mapping = 0.5. If multiple mappings point to the same
technique, retain provenance and use the highest confidence. The available evidence is
CWE-798 hard-coded credential classification on a CVE. Which mapping confidence is
correct?

(a) 0.7, because every MITRE mapping must pass through a CWE.
(b) 1.0, because all ATT&CK mappings are exact once a technique ID is assigned.
(c) 0.7, because this is a CWE-based mapping.
(d) 0.5, because every ICS technique starts as a device-type assumption.

### Question 28

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site maps scan evidence to MITRE ATT&CK for ICS. The Chapter 4
confidence rules are: direct finding-type evidence = 0.8 to 1.0, CWE-based CVE mapping =
0.7, and device-type-only mapping = 0.5. If multiple mappings point to the same
technique, retain provenance and use the highest confidence. The available evidence is
device type is PLC and technique is Modify Controller Tasking. Which mapping confidence
is correct?

(a) 1.0, because all ATT&CK mappings are exact once a technique ID is assigned.
(b) 0.5, because this is a device-type mapping.
(c) 0.5, because every ICS technique starts as a device-type assumption.
(d) 0.7, because every MITRE mapping must pass through a CWE.

### Question 29

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator maps scan evidence to MITRE ATT&CK for ICS. The Chapter 4
confidence rules are: direct finding-type evidence = 0.8 to 1.0, CWE-based CVE mapping =
0.7, and device-type-only mapping = 0.5. If multiple mappings point to the same
technique, retain provenance and use the highest confidence. The available evidence is
direct Nuclei finding for exposed device info. Which mapping confidence is correct?

(a) 1.0, because this is a finding-type mapping.
(b) 0.5, because every ICS technique starts as a device-type assumption.
(c) 0.7, because every MITRE mapping must pass through a CWE.
(d) 1.0, because all ATT&CK mappings are exact once a technique ID is assigned.

### Question 30

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A baggage-handling operator maps scan evidence to MITRE ATT&CK for ICS. The Chapter 4
confidence rules are: direct finding-type evidence = 0.8 to 1.0, CWE-based CVE mapping =
0.7, and device-type-only mapping = 0.5. If multiple mappings point to the same
technique, retain provenance and use the highest confidence. The available evidence is
CWE-306 missing authentication attached to a CVE. Which mapping confidence is correct?

(a) 0.5, because every ICS technique starts as a device-type assumption.
(b) 0.7, because every MITRE mapping must pass through a CWE.
(c) 1.0, because all ATT&CK mappings are exact once a technique ID is assigned.
(d) 0.7, because this is a CWE-based mapping.

### Question 31

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A food processing plant exports Chapter 4 attack-graph findings for sector sharing. The
local STIX 2.1 contract requires these object families: identity, attack-pattern,
ipv4-addr, observed-data, vulnerability, relationship, and report. Which bundle
satisfies the contract without collapsing context into free text?

(a) A bundle containing only indicator and campaign objects.
(b) A bundle containing observed-data objects with all techniques and CVEs embedded as plain text.
(c) A bundle containing identity, attack-pattern, ipv4-addr, observed-data, vulnerability, relationship, and report objects.
(d) A bundle containing only vulnerability objects and a PDF attachment.

### Question 32

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site exports Chapter 4 attack-graph findings for sector
sharing. The local STIX 2.1 contract requires these object families: identity,
attack-pattern, ipv4-addr, observed-data, vulnerability, relationship, and report. Which
bundle satisfies the contract without collapsing context into free text?

(a) A bundle containing observed-data objects with all techniques and CVEs embedded as plain text.
(b) A bundle containing identity, attack-pattern, ipv4-addr, observed-data, vulnerability, relationship, and report objects.
(c) A bundle containing only vulnerability objects and a PDF attachment.
(d) A bundle containing only indicator and campaign objects.

### Question 33

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator exports Chapter 4 attack-graph findings for sector sharing.
The local STIX 2.1 contract requires these object families: identity, attack-pattern,
ipv4-addr, observed-data, vulnerability, relationship, and report. Which bundle
satisfies the contract without collapsing context into free text?

(a) A bundle containing identity, attack-pattern, ipv4-addr, observed-data, vulnerability, relationship, and report objects.
(b) A bundle containing only vulnerability objects and a PDF attachment.
(c) A bundle containing only indicator and campaign objects.
(d) A bundle containing observed-data objects with all techniques and CVEs embedded as plain text.

### Question 34

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A baggage-handling operator exports Chapter 4 attack-graph findings for sector sharing.
The local STIX 2.1 contract requires these object families: identity, attack-pattern,
ipv4-addr, observed-data, vulnerability, relationship, and report. Which bundle
satisfies the contract without collapsing context into free text?

(a) A bundle containing only vulnerability objects and a PDF attachment.
(b) A bundle containing only indicator and campaign objects.
(c) A bundle containing observed-data objects with all techniques and CVEs embedded as plain text.
(d) A bundle containing identity, attack-pattern, ipv4-addr, observed-data, vulnerability, relationship, and report objects.

### Question 35

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility exports Chapter 4 attack-graph findings for sector sharing. The local
STIX 2.1 contract requires these object families: identity, attack-pattern, ipv4-addr,
observed-data, vulnerability, relationship, and report. Which bundle satisfies the
contract without collapsing context into free text?

(a) A bundle containing only indicator and campaign objects.
(b) A bundle containing observed-data objects with all techniques and CVEs embedded as plain text.
(c) A bundle containing identity, attack-pattern, ipv4-addr, observed-data, vulnerability, relationship, and report objects.
(d) A bundle containing only vulnerability objects and a PDF attachment.

### Question 36

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site uses the Chapter 4 greedy what-if rule: calculate
remediation efficiency as risk reduction divided by cost, then select the
highest-efficiency single action first. The candidate actions are: rotate credentials
reduces BRS by 18.0 at cost 2.0; segment VLAN reduces BRS by 31.5 at cost 7.0; patch
cameras reduces BRS by 12.0 at cost 4.0. Which first action follows?

(a) Do not select any action until all attack paths are manually validated.
(b) Select rotate credentials, efficiency 9.00.
(c) Select segment VLAN, because it has the largest absolute risk reduction.
(d) Select rotate credentials, because it has the lowest cost.

### Question 37

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator uses the Chapter 4 greedy what-if rule: calculate remediation
efficiency as risk reduction divided by cost, then select the highest-efficiency single
action first. The candidate actions are: disable Telnet reduces BRS by 24.0 at cost 3.0;
patch PLC CVEs reduces BRS by 36.0 at cost 8.0; add firewall rule reduces BRS by 16.0 at
cost 4.0. Which first action follows?

(a) Select disable Telnet, efficiency 8.00.
(b) Select patch PLC CVEs, because it has the largest absolute risk reduction.
(c) Select disable Telnet, because it has the lowest cost.
(d) Do not select any action until all attack paths are manually validated.

### Question 38

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A baggage-handling operator uses the Chapter 4 greedy what-if rule: calculate
remediation efficiency as risk reduction divided by cost, then select the
highest-efficiency single action first. The candidate actions are: rotate shared
passwords reduces BRS by 21.0 at cost 1.5; upgrade firmware reduces BRS by 28.0 at cost
7.0; remove stale host reduces BRS by 6.0 at cost 2.0. Which first action follows?

(a) Select upgrade firmware, because it has the largest absolute risk reduction.
(b) Select rotate shared passwords, because it has the lowest cost.
(c) Do not select any action until all attack paths are manually validated.
(d) Select rotate shared passwords, efficiency 14.00.

### Question 39

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility uses the Chapter 4 greedy what-if rule: calculate remediation efficiency
as risk reduction divided by cost, then select the highest-efficiency single action
first. The candidate actions are: isolate broker reduces BRS by 30.0 at cost 6.0; patch
sensor CVEs reduces BRS by 14.0 at cost 5.0; rotate RTSP creds reduces BRS by 17.0 at
cost 2.0. Which first action follows?

(a) Select rotate RTSP creds, because it has the lowest cost.
(b) Do not select any action until all attack paths are manually validated.
(c) Select rotate RTSP creds, efficiency 8.50.
(d) Select isolate broker, because it has the largest absolute risk reduction.

### Question 40

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

A power cooperative uses the Chapter 4 greedy what-if rule: calculate remediation
efficiency as risk reduction divided by cost, then select the highest-efficiency single
action first. The candidate actions are: disable UPnP reduces BRS by 11.0 at cost 1.0;
segment OT subnet reduces BRS by 42.0 at cost 9.0; patch HMI reduces BRS by 18.0 at cost
5.0. Which first action follows?

(a) Do not select any action until all attack paths are manually validated.
(b) Select disable UPnP, efficiency 11.00.
(c) Select segment OT subnet, because it has the largest absolute risk reduction.
(d) Select disable UPnP, because it has the lowest cost.

### Question 41

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator runs the Chapter 4 behavioral baseline engine. The engine
emits anomalies only after a device has been observed at least twice. The current
baseline observation_count is 1, and the current scan shows: default credentials now
present. Which evidence statement follows?

(a) Do not emit an anomaly yet; no anomaly yet because the observation-count gate has not been met.
(b) Emit a critical anomaly for every change because OT networks should never change.
(c) Suppress all anomalies unless a CVE is present in CISA KEV.
(d) Delete the baseline because any change proves the old scan was false.

### Question 42

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A baggage-handling operator runs the Chapter 4 behavioral baseline engine. The engine
emits anomalies only after a device has been observed at least twice. The current
baseline observation_count is 3, and the current scan shows: default credentials now
present. Which evidence statement follows?

(a) Emit a critical anomaly for every change because OT networks should never change.
(b) Suppress all anomalies unless a CVE is present in CISA KEV.
(c) Delete the baseline because any change proves the old scan was false.
(d) Emit critical credential_change anomaly.

### Question 43

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility runs the Chapter 4 behavioral baseline engine. The engine emits
anomalies only after a device has been observed at least twice. The current baseline
observation_count is 2, and the current scan shows: one new open port. Which evidence
statement follows?

(a) Suppress all anomalies unless a CVE is present in CISA KEV.
(b) Delete the baseline because any change proves the old scan was false.
(c) Emit medium new_port anomaly.
(d) Emit a critical anomaly for every change because OT networks should never change.

### Question 44

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

A power cooperative runs the Chapter 4 behavioral baseline engine. The engine emits
anomalies only after a device has been observed at least twice. The current baseline
observation_count is 4, and the current scan shows: one formerly open port missing.
Which evidence statement follows?

(a) Delete the baseline because any change proves the old scan was false.
(b) Emit low missing_port anomaly.
(c) Emit a critical anomaly for every change because OT networks should never change.
(d) Suppress all anomalies unless a CVE is present in CISA KEV.

### Question 45

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A pipeline operator runs the Chapter 4 behavioral baseline engine. The engine emits
anomalies only after a device has been observed at least twice. The current baseline
observation_count is 1, and the current scan shows: new firmware string. Which evidence
statement follows?

(a) Do not emit an anomaly yet; no anomaly yet because the baseline is cold.
(b) Emit a critical anomaly for every change because OT networks should never change.
(c) Suppress all anomalies unless a CVE is present in CISA KEV.
(d) Delete the baseline because any change proves the old scan was false.

### Question 46

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A baggage-handling operator finds that a device CVE appears in the CISA KEV catalog. The
Chapter 4 rule is: a KEV CVE match has confidence 1.0 and raises exploitability E to 9.0
if E was lower. The device's pre-match E was 0.0. The BRS weight for E is 0.20. Which
effect follows?

(a) E becomes 10.0; the BRS contribution changes by 2.00.
(b) The vulnerability factor V is deleted because KEV replaces CVSS.
(c) The match is confidence 0.5 because all external intelligence is heuristic.
(d) E becomes 9.0; the BRS contribution from E changes by 1.80.

### Question 47

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility finds that a device CVE appears in the CISA KEV catalog. The Chapter 4
rule is: a KEV CVE match has confidence 1.0 and raises exploitability E to 9.0 if E was
lower. The device's pre-match E was 6.0. The BRS weight for E is 0.20. Which effect
follows?

(a) The vulnerability factor V is deleted because KEV replaces CVSS.
(b) The match is confidence 0.5 because all external intelligence is heuristic.
(c) E becomes 9.0; the BRS contribution from E changes by 0.60.
(d) E becomes 10.0; the BRS contribution changes by 0.80.

### Question 48

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

A power cooperative finds that a device CVE appears in the CISA KEV catalog. The Chapter
4 rule is: a KEV CVE match has confidence 1.0 and raises exploitability E to 9.0 if E
was lower. The device's pre-match E was 7.0. The BRS weight for E is 0.20. Which effect
follows?

(a) The match is confidence 0.5 because all external intelligence is heuristic.
(b) E becomes 9.0; the BRS contribution from E changes by 0.40.
(c) E becomes 10.0; the BRS contribution changes by 0.60.
(d) The vulnerability factor V is deleted because KEV replaces CVSS.

### Question 49

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A pipeline operator finds that a device CVE appears in the CISA KEV catalog. The Chapter
4 rule is: a KEV CVE match has confidence 1.0 and raises exploitability E to 9.0 if E
was lower. The device's pre-match E was 8.0. The BRS weight for E is 0.20. Which effect
follows?

(a) E becomes 9.0; the BRS contribution from E changes by 0.20.
(b) E becomes 10.0; the BRS contribution changes by 0.40.
(c) The vulnerability factor V is deleted because KEV replaces CVSS.
(d) The match is confidence 0.5 because all external intelligence is heuristic.

### Question 50

**Scenario provenance only (not needed to answer):** OASIS STIX 2.1 standard.

A maritime port authority finds that a device CVE appears in the CISA KEV catalog. The
Chapter 4 rule is: a KEV CVE match has confidence 1.0 and raises exploitability E to 9.0
if E was lower. The device's pre-match E was 9.0. The BRS weight for E is 0.20. Which
effect follows?

(a) E becomes 10.0; the BRS contribution changes by 0.20.
(b) The vulnerability factor V is deleted because KEV replaces CVSS.
(c) The match is confidence 0.5 because all external intelligence is heuristic.
(d) E becomes 9.0; the BRS contribution from E changes by 0.00.
