A company has a mature vulnerability management program, but during a recent incident, the incident response team found that the attacker exploited a vulnerability that was not on the company's vulnerability scan reports. The vulnerability was introduced by a configuration change made by a system administrator. The CISO wants to improve the program to catch such issues. Which change is most effective?

Increase the frequency of vulnerability scans to daily.

Integrate configuration management and change management processes with vulnerability scanning to identify configuration-induced vulnerabilities.

Disable configuration changes by system administrators to prevent future issues.

Conduct a penetration test after every configuration change.

A manufacturing firm's security team receives threat intelligence that a ransomware group is actively exploiting a remote code execution vulnerability in the VPN appliance used for remote access. The vendor has released an emergency patch, but the patch requires a 15-minute reboot of the VPN, which would disconnect all remote workers. The firm has a 24/7 production schedule. What should the team do first?

Apply the patch immediately and accept the brief remote access outage.

Implement temporary compensating controls and defer the patch until the vendor confirms stability.

Deploy the patch immediately during the next scheduled maintenance window.

Disable the VPN appliance until the next maintenance window and then patch it.

A healthcare organization wants to verify whether its newly deployed intrusion detection system (IDS) actually detects a known exploit chain that targets its patient portal. The organization has a signed testing agreement with the portal vendor, but the production system contains live patient data. Which approach should the security team take?

Perform a penetration test against a staging replica of the portal and verify IDS alerts.

Deploy the exploit against the production portal during off-peak hours.

Run a credentialed vulnerability scan against the production portal to confirm the missing patches.

Review IDS logs from the last six months for similar exploit patterns.

When an organization decides to accept a risk, what does that imply?

The organization acknowledges the risk and chooses not to take action

The organization will implement controls to reduce the risk

The organization will avoid the activity that creates the risk

The organization will transfer the risk to an insurer

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 4

Threat and Vulnerability Management CCISO Practice Questions (Page 7)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 31–35

31expert · hard
A company has a mature vulnerability management program, but during a recent incident, the incident response team found that the attacker exploited a vulnerability that was not on the company's vulnerability scan reports. The vulnerability was introduced by a configuration change made by a system administrator. The CISO wants to improve the program to catch such issues. Which change is most effective?
Select an answer first
32application · medium
A manufacturing firm's security team receives threat intelligence that a ransomware group is actively exploiting a remote code execution vulnerability in the VPN appliance used for remote access. The vendor has released an emergency patch, but the patch requires a 15-minute reboot of the VPN, which would disconnect all remote workers. The firm has a 24/7 production schedule. What should the team do first?
Select an answer first
33foundation · easy
Which risk mitigation strategy involves purchasing an insurance policy to cover potential losses from a security breach?
Select an answer first
34application · medium
A healthcare organization wants to verify whether its newly deployed intrusion detection system (IDS) actually detects a known exploit chain that targets its patient portal. The organization has a signed testing agreement with the portal vendor, but the production system contains live patient data. Which approach should the security team take?
Select an answer first
35foundation · easy
When an organization decides to accept a risk, what does that imply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Threat and Vulnerability Management CCISO Practice Questions (Page 7)

Questions 31–35

Which risk mitigation strategy involves purchasing an insurance policy to cover potential losses from a security breach?

When an organization decides to accept a risk, what does that imply?

Keep studying — Information Security Core Competencies