Vulnerability Management GSLC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When interpreting vulnerability scan results, what does a 'false positive' mean?

   • AThe vulnerability is present but has a very low risk rating
   • BThe vulnerability was patched but the scanner still reports it
   • CThe scanner missed a vulnerability that is actually present
   • DThe scanner reported a vulnerability that does not actually exist
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A critical vulnerability has been identified in a third-party application that is used by the HR department. The vendor has released a patch, but the patch is known to cause compatibility issues with the company's single sign-on (SSO) system. The HR application is essential for payroll processing. What should the security team do?

   • AUninstall the SSO system to avoid compatibility issues.
   • BDeploy the patch immediately to all HR systems to reduce the vulnerability risk.
   • CAccept the risk and do not patch because of the compatibility issue.
   • DTest the patch in a non-production environment before deploying it.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A manufacturing company has a legacy SCADA system that controls a critical production line. A vulnerability scan found a remotely exploitable flaw in the system's web interface. The vendor has not released a patch and will not provide one for at least six months. The system cannot be taken offline during production hours, and the company has a low risk tolerance. Which remediation strategy best balances risk reduction with operational continuity?

   • ATake the system offline immediately until a patch is available, regardless of production impact
   • BAccept the risk because the vendor has not released a patch and the system is essential to production
   • CImplement compensating controls, such as network segmentation and strict access control, while monitoring for exploitation attempts
   • DApply a configuration change to disable the web interface, even if it breaks remote monitoring
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An incident response team is handling a ransomware event that exploited a known vulnerability in an internet-facing application. The vulnerability had been identified in a scan but was not remediated because it was assigned a medium severity. After the incident, the security manager wants to prevent similar events. Which change to the vulnerability management program would be most effective?

   • ADisable the vulnerability scanning tool because it did not prevent the incident
   • BRequire incident response to approve all vulnerability scan reports
   • CIncrease the frequency of vulnerability scans to weekly
   • DAdjust the risk rating methodology to consider active exploitation in the wild, not just CVSS severity
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A vulnerability management team is reviewing the results of a quarterly scan. The scan identified a critical vulnerability in a database server that stores customer payment information. The database is not directly accessible from the internet, but it is accessible from the internal network. The team has a limited patching window and must decide which vulnerabilities to remediate first. The scan also identified a high-severity vulnerability in a public-facing web server that is not critical to business operations. The threat intelligence team reports that the database vulnerability is not being exploited in the wild, while the web server vulnerability is being actively exploited. What should the team do?

   • APatch both at the same time because both are important.
   • BPatch the database server first because it contains sensitive payment information.
   • CPatch the web server first because it is actively exploited and internet-facing.
   • DPatch the database server first because it has a higher CVSS score.
   Reveal Solution Discussion Select an answer first