Vulnerability Management Reporting CS0-003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a valid Key Performance Indicator (KPI) for a vulnerability management program?

   • AThe number of security incidents reported in the last quarter
   • BThe number of employees who have completed security awareness training
   • CThe total amount of storage used by the vulnerability scanner
   • DThe percentage of critical vulnerabilities remediated within the defined SLA
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security analyst discovers that a critical vulnerability in a legacy application cannot be patched because the vendor no longer provides updates. What is this an example of?

   • AAn inhibitor to remediation
   • BA false positive in the vulnerability scan
   • CA lack of stakeholder support
   • DA compliance requirement
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has identified a critical vulnerability in a customer-facing web application. The team wants to communicate the risk to the business owner, who is concerned about the potential impact on customer trust. Which communication approach would best address the business owner's concern?

   • AState that the vulnerability is critical and must be fixed immediately.
   • BProvide the CVSS score and technical details of the vulnerability.
   • CExplain the vulnerability in terms of the potential for data breach and the impact on customer trust, and propose a remediation plan with a timeline.
   • DAsk the business owner to approve a patch window without explaining the risk.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company's vulnerability scanner identified a critical remote code execution vulnerability in a legacy production server that cannot be patched immediately because it runs a proprietary application. The server is isolated on a separate network segment. The security manager needs to implement an action plan to reduce risk while a permanent fix is developed. Which action should be prioritized?

   • AApply a virtual patch or intrusion prevention system (IPS) signature to block exploit attempts.
   • BIncrease the frequency of vulnerability scans on that server.
   • CDocument the vulnerability in the risk register and take no further action.
   • DRemove the server from the network until the vendor releases a patch.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company must demonstrate compliance with the ISO 27001 standard, which requires evidence of vulnerability management activities. The auditor asks for a report showing that vulnerabilities are being identified and remediated in a controlled manner. Which report would best satisfy this requirement?

   • AA summary of the number of vulnerabilities fixed in the last month.
   • BA report showing the vulnerability management process, including scan schedules, remediation SLAs, and metrics on remediation progress.
   • CA list of all vulnerabilities found in the last scan with their CVSS scores.
   • DA penetration test report from an external vendor.
   Reveal Solution Discussion Select an answer first