Threat and Vulnerability Management CCISO Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A hospital's IT team is managing patches for its electronic health record (EHR) system. The vendor releases a critical security patch, but the hospital's change advisory board (CAB) requires that all patches be tested in a staging environment for two weeks before production deployment. The threat intelligence community reports that the vulnerability is being actively exploited in healthcare. The hospital's CISO must decide how to proceed. Which option best balances security and operational stability?

   • ADeploy the patch to production immediately, bypassing the CAB process, because of the active threat.
   • BDisconnect the EHR system from the internet until the patch is deployed.
   • CConvene an emergency CAB meeting to expedite testing and deployment while implementing temporary compensating controls.
   • DFollow the CAB process and wait two weeks before deploying the patch.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A security team is planning to deploy a vulnerability scanner across a large enterprise network. The CISO is concerned about the scanner being detected by attackers and about the accuracy of the results. Which configuration choice best addresses both concerns?

   • ARun unauthenticated scans from a single IP address to avoid detection.
   • BDisable logging on the scanner to avoid leaving traces.
   • CRun authenticated scans using a dedicated service account with minimal privileges.
   • DRun scans only during business hours to blend in with normal traffic.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A company's patch management team is struggling to keep up with the volume of patches released each month. The CISO wants to prioritize patches based on risk. The company has a mix of internet-facing web servers, internal file servers, and development workstations. Which prioritization strategy is most effective?

   • APatch development workstations first because they are used by developers.
   • BPatch only the systems that have been compromised in the past.
   • CPrioritize patches based on the criticality of the asset and the severity of the vulnerability, with internet-facing systems receiving the highest priority.
   • DPatch all systems in alphabetical order to ensure fairness.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A company's risk assessment identifies a critical vulnerability in a custom-built application that is central to its operations. The vendor is no longer in business, and the source code is available. The company has a small development team that is already overburdened with feature requests. The CISO must decide how to mitigate the risk. Which option is the most practical?

   • AAccept the risk because the application is critical and cannot be changed.
   • BImplement compensating controls such as a web application firewall and strict access controls while planning a long-term fix.
   • CReplace the application with a commercial off-the-shelf product immediately.
   • DAssign the development team to fix the vulnerability immediately, even if it delays other projects.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   After a security incident, the incident response team discovers that an attacker exploited a vulnerability that had been identified in a vulnerability scan six months earlier but was never remediated. The CISO wants to prevent this from recurring. Which action is most directly aligned with integrating vulnerability management and incident response?

   • AConduct a post-incident review to identify the root cause of the breach.
   • BIncrease the frequency of vulnerability scans to weekly.
   • CEstablish a formal remediation SLA that ties vulnerability findings to owners and tracks them to closure.
   • DAdd the exploited vulnerability to the incident response playbook.
   Reveal Solution Discussion Select an answer first