Vulnerability Management Reporting CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security manager is preparing a report for the executive team. The executives want to see a KPI that demonstrates the business value of the vulnerability management program. Which KPI would best demonstrate business value?

   • ANumber of security analysts on the team.
   • BPercentage of critical vulnerabilities remediated within the SLA.
   • CAverage time to complete a vulnerability scan.
   • DTotal number of vulnerabilities found in the last quarter.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When communicating vulnerability management findings to executive leadership, what is the most effective approach?

   • AProvide a detailed technical report with all CVSS scores and exploit details
   • BOnly communicate the vulnerabilities that have a CVSS score of 9.0 or higher
   • CFocus on the business impact, risk, and recommended actions in a high-level summary
   • DShare the raw vulnerability scan data for them to analyze
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team wants to measure the effectiveness of its vulnerability management program. They currently track the number of vulnerabilities found each month. The team lead wants a metric that reflects how quickly the team responds to newly discovered critical vulnerabilities. Which metric should they add?

   • AMean time to remediate (MTTR) for critical vulnerabilities
   • BPercentage of assets with agent-based scanning installed
   • CTotal number of assets scanned per month
   • DNumber of false positives reported by the scanner
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a vulnerability management metric?

   • AThe number of employees in the IT department
   • BThe brand of the vulnerability scanner used
   • CThe number of firewall rules in the network
   • DThe percentage of vulnerabilities remediated within 30 days
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to evaluate whether its vulnerability management program is improving over time. They have been tracking the number of open vulnerabilities each month. Which additional metric would provide the most insight into the effectiveness of their remediation efforts?

   • APercentage of vulnerabilities remediated within 30 days of discovery.
   • BTotal number of vulnerabilities discovered each month.
   • CAverage CVSS score of all open vulnerabilities.
   • DNumber of vulnerability scanners in use.
   Reveal Solution Discussion Select an answer first