Cisco CyberOps Associate (CBROPS) 200-201Vulnerability ManagementMedium
An organization is implementing a continuous vulnerability management program. As part of this, they need to ensure that security vulnerabilities are classified consistently and that information about them can be easily shared and understood across different security tools and teams. Which standardized system is primarily used for this purpose, providing unique identifiers and common names for publicly known information security vulnerabilities?
- ANIST SP 800-53
- BCVSS (Common Vulnerability Scoring System)
- CCWE (Common Weakness Enumeration)
- DCVE (Common Vulnerabilities and Exposures)
Show answer & explanationAnswer & explanation
Correct answer: D. CVE (Common Vulnerabilities and Exposures)
CVE provides a dictionary of common names (CVE IDs) for publicly known cybersecurity vulnerabilities. This standardization allows for consistent identification and sharing of vulnerability information across different tools and databases.
Why the other options are wrong
- A. NIST SP 800-53 is a catalog of security and privacy controls, not a vulnerability identification system.
- B. CVSS provides a numerical score for vulnerability severity, not unique identifiers or common names.
- C. CWE is a list of common software weakness types, not specific instances of vulnerabilities.
CVE (Common Vulnerabilities and Exposures)
A list of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identifier (CVE ID) and common name.
- Standardizes vulnerability identification.
- Enables consistent data sharing across security tools.
- Does not include scoring or detailed remediation advice.
Memory trick: CVE is the 'ID card' for every unique vulnerability.