Vulnerability Management GSLC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following best describes 'exploitability' in the context of risk-based prioritization?

   • AThe likelihood that a vulnerability can be successfully exploited by an attacker
   • BThe number of vendors that have released patches
   • CThe amount of data that could be stolen
   • DThe cost of purchasing a commercial exploit tool
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is establishing a vulnerability management program. The security manager wants to ensure that the program is continuous and not just a one-time effort. Which set of activities best represents a continuous vulnerability management lifecycle?

   • AScan once, fix all findings, and then stop.
   • BScan, assess, remediate, verify, and repeat on a regular schedule.
   • CRely on vendor patches without scanning.
   • DOnly scan when a new vulnerability is announced.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What does 'accepting the risk' mean as a remediation strategy?

   • ATransferring the risk to an insurance company without any action
   • BImmediately applying a patch to eliminate the vulnerability
   • CDeleting the vulnerable system from the network
   • DFormally acknowledging the vulnerability and deciding not to fix it, based on a cost-benefit analysis
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A vulnerability management team has remediated a set of high-risk vulnerabilities. The team lead must report the status to the IT director, who wants to know whether the risk has actually been reduced. Which reporting metric would best demonstrate remediation effectiveness?

   • AThe time since the last vulnerability scan was completed
   • BThe number of patches deployed by the IT team
   • CThe percentage of critical and high vulnerabilities that have been remediated and verified
   • DThe total number of vulnerabilities identified in the last scan
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which factor is most important when prioritizing which vulnerability to remediate first?

   • AThe date the vulnerability was first discovered
   • BThe number of characters in the vulnerability description
   • CThe vulnerability's CVE ID number
   • DThe asset's criticality to business operations
   Reveal Solution Discussion Select an answer first