Vulnerability Management GSLC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A vulnerability scan of a network segment reports a large number of false positives. The security analyst needs to improve the accuracy of the scan results before prioritizing remediation. Which action would most effectively reduce false positives?

   • AConfigure the scanner with valid credentials for authenticated scanning
   • BDisable the vulnerability signatures that produce false positives
   • CIncrease the scan intensity to perform more aggressive checks
   • DRun the scan only during off-peak hours
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   When reporting vulnerability status to stakeholders, what is a key characteristic of an effective report?

   • AIt only includes vulnerabilities that have been fully remediated
   • BIt lists every vulnerability with its full CVE description
   • CIt avoids mentioning any residual risk
   • DIt uses clear, non-technical language and focuses on business risk
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A vulnerability management team has completed a remediation cycle. The team needs to report to the board of directors. The board is not technical and wants a high-level summary of the organization's risk posture. Which reporting approach is most appropriate?

   • AProvide a detailed list of every vulnerability with its CVSS score and affected system.
   • BReport only the number of vulnerabilities that were remediated this quarter.
   • CShare the raw scan reports with the board.
   • DPresent a dashboard showing the percentage of critical vulnerabilities remediated and the remaining risk exposure.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is an example of a vendor advisory that provides vulnerability information?

   • AMicrosoft Security Response Center (MSRC) advisories
   • BAn organization's asset inventory spreadsheet
   • CA firewall's packet capture logs
   • DA company's internal incident response plan
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company discovers a critical vulnerability in a legacy application that is no longer supported by the vendor. The application is essential to business operations and cannot be replaced in the short term. Which remediation strategy is most appropriate?

   • AAccept the risk because the application is no longer supported
   • BStop using the application immediately
   • CAttempt to patch the application using an unofficial patch from the internet
   • DApply compensating controls, such as network isolation and strict access controls, and plan for application replacement
   Reveal Solution Discussion Select an answer first