A security operations center (SOC) analyst receives an alert from Prisma Cloud indicating a critical vulnerability (CVE-2023-XXXX) detected in a container image used by a production application. The analyst needs to quickly determine if this specific vulnerability is actively exploitable within their environment, considering the image's runtime configuration and deployed context. Which Prisma Cloud capability provides the most relevant context for exploitability?
- ACompliance Explorer Report
- BRuntime Radar
- CVulnerability Exploitability Index (VEX)
- DRegistry Scan Report
Show answer & explanationAnswer & explanation
Correct answer: C. Vulnerability Exploitability Index (VEX)
The Vulnerability Exploitability Index (VEX) in Prisma Cloud provides additional context beyond standard CVE scoring, indicating whether a vulnerability is actually exploitable in a given environment by analyzing factors like the presence of vulnerable code paths, mitigation controls, and runtime context. It helps prioritize remediation efforts by distinguishing between detectable vulnerabilities and truly exploitable ones.
Why the other options are wrong
- A. Compliance Explorer reports on adherence to security benchmarks, not vulnerability exploitability.
- B. Runtime Radar visualizes network connections and process activity, but not direct exploitability of a CVE.
- D. Registry Scan Report lists all detected vulnerabilities but doesn't provide exploitability context.
Prisma Cloud VEX
Vulnerability Exploitability Index (VEX) provides context on whether a detected vulnerability is actually exploitable in a specific environment, helping to prioritize remediation.
- Goes beyond CVE scores.
- Considers runtime context and mitigations.
- Helps prioritize true risks.
Memory trick: Don't just scan, use VEX to understand the real 'bang' of a vulnerability.