A vulnerability management team has remediated a set of critical vulnerabilities across the environment. The team lead must report the status to the CISO. The CISO wants to know which vulnerabilities are truly fixed and which remain open. The team has already applied patches and configuration changes. What should the team do before reporting to the CISO?

Rescan the affected assets to confirm the vulnerabilities are no longer present.

Update the vulnerability database with the new patch versions.

Report the remediation status based on the patching team's confirmation.

Review the original scan reports and mark all remediated items as closed.

After a critical vulnerability was patched across 200 servers, the vulnerability management lead must report status to the CISO. The lead wants to confirm that the patch was actually applied and that no server remains vulnerable. Which action should the lead take to verify remediation effectiveness?

Check the CVE database for any new advisories related to the patched vulnerability

Review the patch deployment logs from the patch management tool and assume all servers are compliant

Ask system administrators to confirm verbally that their servers were patched

Run an authenticated vulnerability scan against the patched servers and compare results to the pre-patch baseline

What is the primary purpose of verifying remediation efforts?

To calculate the financial cost of the vulnerability

To assign a CVE identifier to the vulnerability

To confirm that the vulnerability has been effectively eliminated or mitigated

To determine who discovered the vulnerability

A security analyst is reviewing a vulnerability scan report and sees a critical vulnerability on a server that is scheduled for decommissioning in two weeks. The server is not accessible from the internet and contains no sensitive data. What should the analyst do?

Patch the server immediately because the vulnerability is critical

Document the vulnerability and accept the risk because the server is being decommissioned soon

Move the server to a more isolated network segment

Ignore the vulnerability because the server is being decommissioned

How does vulnerability management support incident response during an active security incident?

By automatically terminating the attacker's session

By replacing the incident response team

By providing information about known vulnerabilities that may have been exploited

By deleting all logs to prevent further damage

GIAC Security Leadership

Domain 3Objective 4

Vulnerability Management GSLC Practice Questions (Page 3)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

Questions 11–15

11application · medium
A vulnerability management team has remediated a set of critical vulnerabilities across the environment. The team lead must report the status to the CISO. The CISO wants to know which vulnerabilities are truly fixed and which remain open. The team has already applied patches and configuration changes. What should the team do before reporting to the CISO?
Select an answer first
12application · medium
After a critical vulnerability was patched across 200 servers, the vulnerability management lead must report status to the CISO. The lead wants to confirm that the patch was actually applied and that no server remains vulnerable. Which action should the lead take to verify remediation effectiveness?
Select an answer first
13foundation · easy
What is the primary purpose of verifying remediation efforts?
Select an answer first
14application · medium
A security analyst is reviewing a vulnerability scan report and sees a critical vulnerability on a server that is scheduled for decommissioning in two weeks. The server is not accessible from the internet and contains no sensitive data. What should the analyst do?
Select an answer first
15foundation · easy
How does vulnerability management support incident response during an active security incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Vulnerability Management GSLC Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of verifying remediation efforts?

A security analyst is reviewing a vulnerability scan report and sees a critical vulnerability on a server that is scheduled for decommissioning in two weeks. The server is not accessible from the internet and contains no sensitive data. What should the analyst do?

How does vulnerability management support incident response during an active security incident?

Keep studying — Security Operations and Incident Management