Threat and Vulnerability Management CCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized company's patch management team applies security updates to servers every month. After a recent patch deployment, a critical line-of-business application became unstable, causing a service outage. The CISO wants to reduce the risk of future patch-related outages while still addressing vulnerabilities promptly. Which change to the patch management process is most effective?

   • ADeploy patches only to non-critical servers and leave critical systems unpatched.
   • BAutomate patch deployment to all servers without any pre-deployment checks.
   • CDelay all patches by at least 90 days to allow the vendor to fix any issues.
   • DTest patches in a staging environment that mirrors production before deployment.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A multinational corporation operates in a country with strict data protection regulations. The company's risk assessment has identified a high likelihood of a specific type of cyberattack, but the cost to fully remediate the vulnerability is very high. The CISO must decide between accepting the risk, transferring it via insurance, or implementing partial controls. The company has a legal obligation to protect customer data. Which decision framework is most appropriate?

   • ATransfer the risk entirely to a cyber insurance policy.
   • BAccept the risk because the cost of full remediation is too high.
   • CImplement partial controls to reduce the risk to an acceptable level and document the residual risk, considering legal obligations.
   • DIgnore the risk assessment and rely on the company's existing security controls.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A utility company is conducting a risk assessment for its industrial control system (ICS) network. The assessment identifies a vulnerability in a legacy controller that could allow an attacker to manipulate physical processes. The vendor no longer supports the controller, and replacing it would cost $2 million and take 18 months. The company's safety team estimates that a successful attack could cause $50 million in damages and potential loss of life. The company has a limited budget and must decide on a risk treatment. Which option is the most defensible?

   • AImmediately replace the controller with a modern one, regardless of cost and timeline.
   • BTransfer the risk by purchasing a cyber insurance policy.
   • CImplement compensating controls such as network segmentation, strict access control, and continuous monitoring.
   • DAccept the risk because the cost of replacement is high.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is migrating its on-premises servers to a cloud environment. The CISO wants to ensure that the cloud instances are configured securely from the start. Which practice is most aligned with security configuration management?

   • AUse the cloud provider's default image for all instances to ensure compatibility.
   • BDisable security groups and rely on the cloud provider's network firewall.
   • CDeploy cloud instances from a hardened golden image that has been reviewed and approved by the security team.
   • DAllow developers to create instances from any public image and then harden them after deployment.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After a ransomware incident, a hospital's security team reviews the timeline and finds that the initial access was gained through a vulnerability that had been identified in a vulnerability scan three months earlier but was not remediated because it was rated medium severity. The team wants to prevent a recurrence. What should the team implement?

   • AA new intrusion detection system to catch similar attacks in the future.
   • BA policy to patch all vulnerabilities within 24 hours of discovery.
   • CA process to re-evaluate vulnerability severity based on current threat intelligence and business impact.
   • DA monthly meeting to review vulnerability scan reports with IT staff.
   Reveal Solution Discussion Select an answer first