Threat and Vulnerability Management CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's threat intelligence team receives a report that a zero-day vulnerability is being exploited in the wild in a software product the company uses. The vendor has not released a patch, and the company cannot immediately upgrade to a different product. The CISO must decide how to respond. The company has a low tolerance for downtime. Which response is most appropriate?

   • AWait for the vendor to release a patch without taking any action.
   • BImplement temporary compensating controls, such as network segmentation and enhanced monitoring, while monitoring the vendor for a patch.
   • CReplace the software with an open-source alternative immediately.
   • DImmediately disconnect all systems running the vulnerable software from the network.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of threat intelligence in vulnerability management?

   • ATo replace the need for vulnerability scanning
   • BTo provide a list of all known vulnerabilities
   • CTo provide context about which vulnerabilities are actively exploited in the wild
   • DTo automatically patch all vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a common source of threat intelligence?

   • AThe vulnerability scanner's report
   • BThe organization's firewall logs
   • CThe company's employee directory
   • DInformation Sharing and Analysis Centers (ISACs)
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational corporation's security operations center receives a threat intelligence feed that indicates a new zero-day vulnerability is being exploited in the wild in a widely used enterprise application. The vendor has not yet released a patch. The corporation has both a development environment and a production environment running the application. The CISO must decide how to respond. Which approach best balances risk and business continuity?

   • AImmediately shut down the production application until the vendor releases a patch.
   • BApply the patch from the development environment to production, even though it is not fully tested.
   • CWait for the vendor to release a patch and then apply it immediately.
   • DApply temporary compensating controls in production, such as network segmentation and enhanced monitoring, while tracking the vendor's patch release.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations team receives a threat intelligence report indicating that a specific malware family is being distributed through malicious macros in Word documents. The report includes indicators of compromise (IOCs) such as file hashes and command-and-control (C2) domains. The team wants to use this intelligence to improve its defenses. Which action is most appropriate?

   • AConduct a vulnerability scan to identify systems that may be affected.
   • BWait for the next scheduled patch cycle to update all systems.
   • CUpdate endpoint detection and response (EDR) rules and email gateway filters with the IOCs.
   • DAdd the IOCs to the risk register as a new risk item.
   Reveal Solution Discussion Select an answer first