A security operations center (SOC) is investigating a potential intrusion. The analyst notices that the attacker used a vulnerability that was identified in a scan but not yet patched. Which action should the analyst take to integrate vulnerability management with incident response?

Ask the vulnerability management team to stop scanning until the incident is resolved

Wait until the incident is closed before reporting the vulnerability

Include the unpatched vulnerability in the incident timeline and recommend expedited remediation as part of the response

Delete the vulnerability from the scan report to avoid confusion

In the vulnerability management lifecycle, what is the primary purpose of the verification phase?

To decide whether to accept, remediate, or mitigate a vulnerability

To identify new vulnerabilities that have appeared since the last scan

To confirm that remediation actions have been successfully implemented

To assign a risk rating to each vulnerability based on business impact

A security operations center (SOC) has detected an intrusion that exploited a known vulnerability in a web application. The vulnerability was identified in a scan two months ago, but it was not remediated because the application owner claimed that the risk was low. The incident response team has contained the breach. The security manager wants to prevent similar incidents in the future. What should the security manager do?

Review the vulnerability management process to ensure that risk decisions are based on current threat intelligence and that exceptions are periodically re-evaluated.

Blame the application owner for not remediating the vulnerability.

Increase the frequency of vulnerability scans to catch vulnerabilities sooner.

Immediately patch the vulnerability and close the incident.

What is the primary purpose of a vulnerability scanner?

To automatically detect known vulnerabilities in systems and applications

To block malicious network traffic in real time

To encrypt data at rest on servers

To authenticate users accessing the network

A vulnerability scan of a web application reports a high-severity SQL injection vulnerability. The scan also reports a medium-severity cross-site scripting (XSS) vulnerability in a low-traffic internal tool. The application team has limited time and asks the security analyst which to fix first. Which factor should the analyst consider as the most important when prioritizing?

The age of the vulnerability scan report

The number of users who access the internal tool

The exploitability and potential impact of the SQL injection on the application's data

The cost of fixing the XSS vulnerability, which is lower than the cost of fixing SQL injection

GIAC Security Leadership

Domain 3Objective 4

Vulnerability Management GSLC Practice Questions (Page 8)

Part of the Security Operations and Incident Management domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

Questions 36–40

36application · medium
A security operations center (SOC) is investigating a potential intrusion. The analyst notices that the attacker used a vulnerability that was identified in a scan but not yet patched. Which action should the analyst take to integrate vulnerability management with incident response?
Select an answer first
37foundation · easy
In the vulnerability management lifecycle, what is the primary purpose of the verification phase?
Select an answer first
38expert · hard
A security operations center (SOC) has detected an intrusion that exploited a known vulnerability in a web application. The vulnerability was identified in a scan two months ago, but it was not remediated because the application owner claimed that the risk was low. The incident response team has contained the breach. The security manager wants to prevent similar incidents in the future. What should the security manager do?
Select an answer first
39foundation · easy
What is the primary purpose of a vulnerability scanner?
Select an answer first
40application · medium
A vulnerability scan of a web application reports a high-severity SQL injection vulnerability. The scan also reports a medium-severity cross-site scripting (XSS) vulnerability in a low-traffic internal tool. The application team has limited time and asks the security analyst which to fix first. Which factor should the analyst consider as the most important when prioritizing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Vulnerability Management GSLC Practice Questions (Page 8)

Questions 36–40

A security operations center (SOC) is investigating a potential intrusion. The analyst notices that the attacker used a vulnerability that was identified in a scan but not yet patched. Which action should the analyst take to integrate vulnerability management with incident response?

In the vulnerability management lifecycle, what is the primary purpose of the verification phase?

What is the primary purpose of a vulnerability scanner?

Keep studying — Security Operations and Incident Management