Threat and Vulnerability Management CCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the role of lessons learned from incidents in vulnerability management?

   • ATo assign blame for the incident
   • BTo close the incident without further action
   • CTo replace the need for regular vulnerability scans
   • DTo update vulnerability assessments and prioritize future remediation
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the first step in the patch management lifecycle?

   • AIdentifying available patches and updates
   • BTesting the patch in a staging environment
   • CDeploying the patch to production systems
   • DDocumenting the patch deployment
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company's security team subscribes to a threat intelligence feed that reports a new exploit kit actively targeting a specific version of a widely used industrial control system (ICS) software. The company runs that exact version in several plants. The vendor has not yet released a patch. What should the CISO do first?

   • AImmediately shut down all affected ICS systems until the vendor releases a patch.
   • BReplace all ICS software with a different vendor's product that is not targeted.
   • CWait for the vendor's patch and continue normal operations because the threat feed is only informational.
   • DVerify whether any plant systems are exposed to the internet or untrusted networks, then apply compensating controls such as network segmentation or access restrictions.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is deploying a new application that requires a specific set of ports to be open on the firewall. The security team has a policy that all servers must be hardened according to a baseline. The application vendor recommends disabling the local firewall on the server to ensure compatibility. The CISO must decide how to proceed. What is the best course of action?

   • ADisable the local firewall as the vendor recommends to ensure application functionality.
   • BIgnore the vendor's recommendation and keep the firewall enabled with all ports open.
   • CAsk the vendor to rewrite the application to work with the firewall enabled.
   • DKeep the local firewall enabled and open only the specific ports required by the application.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the key difference between a vulnerability assessment and a penetration test?

   • AA vulnerability assessment exploits vulnerabilities, while a penetration test only identifies them
   • BBoth are identical in scope and methodology
   • CA vulnerability assessment identifies vulnerabilities, while a penetration test exploits them to determine impact
   • DA penetration test is automated, while a vulnerability assessment is manual
   Reveal Solution Discussion Select an answer first