Vulnerability Management GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How does vulnerability management primarily help reduce the likelihood of security incidents?

   • ABy detecting active intrusions in real time
   • BBy encrypting all network traffic
   • CBy providing legal advice during an incident
   • DBy identifying and fixing weaknesses before attackers can exploit them
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security manager is responsible for vulnerability management in a healthcare organization. A vulnerability scan identified a critical vulnerability in a medical device that is used in patient care. The device cannot be patched because the vendor has not released a patch, and the device is required for patient monitoring. The device is connected to the hospital network, but it is isolated in a separate VLAN. The organization has a policy that requires all critical vulnerabilities to be remediated within 30 days. The vulnerability has been open for 45 days. What should the security manager do?

   • AReplace the device with a patched alternative immediately.
   • BIgnore the policy because the device is critical for patient care.
   • CDocument the risk acceptance and implement additional compensating controls, such as monitoring and stricter access controls.
   • DDisconnect the device from the network immediately to comply with the policy.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst at a regional bank has completed a quarterly vulnerability scan. The scan identified a critical-severity SQL injection flaw in an internet-facing customer portal, a high-severity flaw in an internal HR application that requires authentication, and a medium-severity flaw in a legacy file server that is isolated from the network. The bank's risk appetite is low, but the patching team has limited capacity this week. Which remediation priority should the analyst recommend?

   • APatch the SQL injection flaw first, then the HR application, and defer the file server flaw
   • BPatch the HR application first because it contains sensitive employee data, then the SQL injection, then the file server
   • CDefer all patching until the next scheduled maintenance window to avoid disrupting business operations
   • DPatch all three vulnerabilities in parallel, regardless of severity, to reduce overall risk fastest
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A vulnerability management team has completed a remediation cycle for a set of critical vulnerabilities. The team lead needs to report to the CISO, who is concerned about the organization's risk posture. The CISO wants to know which vulnerabilities are still open and what the residual risk is. The team has already patched 80% of the critical vulnerabilities. The remaining 20% are on systems that cannot be patched because they are legacy. The team has implemented compensating controls for those systems. What should the team report to the CISO?

   • AReport only the 80% that were remediated and omit the remaining 20%.
   • BReport the remaining 20% as a list of technical details without context.
   • CReport the percentage of vulnerabilities remediated and the residual risk, including the compensating controls in place for the remaining vulnerabilities.
   • DReport that all critical vulnerabilities have been remediated because compensating controls are in place.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is building a vulnerability management program for a mid-sized company. The analyst wants to ensure that newly disclosed vulnerabilities are identified as soon as they are publicly known. Which combination of sources should the analyst use to stay informed?

   • AOnly the National Vulnerability Database (NVD), because it is the most comprehensive source
   • BOnly automated vulnerability scanning tools, because they detect all known vulnerabilities
   • CVendor security advisories, CVE databases, and automated vulnerability scanning tools
   • DOnly vendor advisories, because they are the first to announce vulnerabilities
   Reveal Solution Discussion Select an answer first