Threat and Vulnerability Management CCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a vulnerability assessment, what does the 'quantify' step involve?

   • AAssigning a severity score to each identified vulnerability
   • BExploiting the vulnerability to measure its impact
   • CPatching the vulnerability immediately
   • DIdentifying the vulnerability's existence
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does vulnerability management contribute to incident response?

   • ABy eliminating the need for incident response
   • BBy automatically containing security incidents
   • CBy replacing the incident response team
   • DBy providing a list of known vulnerabilities that may be exploited during an incident
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which phase of a penetration test involves gathering information about the target without actively engaging with it?

   • AExploitation
   • BReporting
   • CReconnaissance
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company experienced a ransomware incident that originated from an unpatched vulnerability in a public-facing application. The incident response team contained the attack and restored systems from backups. The CISO wants to ensure that the same vulnerability cannot be exploited again. Which action is most important to include in the post-incident improvement plan?

   • ADisable the public-facing application permanently.
   • BReplace the incident response team to avoid similar mistakes.
   • CIncrease the frequency of backups to every hour.
   • DVerify that the vulnerability has been patched on all affected systems and that no other systems share the same exposure.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an internal threat to an organization's information assets?

   • AA zero-day exploit targeting a public-facing web server
   • BA disgruntled employee who misuses their legitimate access to exfiltrate sensitive data
   • CA distributed denial-of-service (DDoS) attack launched by an external hacktivist group
   • DA ransomware infection that enters through a phishing email from an external sender
   Reveal Solution Discussion Select an answer first