nerdexam
Microsoft

GH-500 · Question #93

Which two pieces of information should be included in a security advisory?

The correct answer is A. Product affected and severity. Security advisories must contain the affected product and severity rating so that recipients can assess whether their systems are at risk and prioritize their response appropriately.

Describe GitHub Advanced Security best practices, results, and how to take corrective measures

Question

Which two pieces of information should be included in a security advisory?

Options

  • AProduct affected and severity.
  • BSeverity and exposure list.
  • CAdministrator name and severity.
  • DExposures list and administrator name.

How the community answered

(42 responses)
  • A
    88% (37)
  • B
    2% (1)
  • C
    2% (1)
  • D
    7% (3)

Why each option

Security advisories must contain the affected product and severity rating so that recipients can assess whether their systems are at risk and prioritize their response appropriately.

AProduct affected and severity.Correct

A security advisory's two most essential fields are the affected product, which identifies exactly which software or hardware is vulnerable, and the severity, which is typically expressed as a CVSS score or equivalent rating. Together these fields let administrators triage exposure quickly and determine urgency without additional research. All other advisory details (mitigations, patches, CVE IDs) are supplemental to this core pair.

BSeverity and exposure list.

An 'exposure list' is not a standard required field in a security advisory, and pairing it with severity still omits the affected product, leaving recipients unable to determine if their environment is impacted.

CAdministrator name and severity.

The administrator name is an operational contact detail and has no bearing on the vulnerability itself - it does not help recipients assess risk or scope.

DExposures list and administrator name.

Neither an 'exposures list' nor an administrator name are recognized standard required components of a security advisory; both omit the critical affected product information.

Concept tested: Required components of a security advisory

Source: https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories

Topics

#Security Advisory#Vulnerability Disclosure#Remediation Information#Best Practices

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GH-500 Practice