Understand Vulnerability Context and Remediation Frameworks GH-500 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A code scanning alert flags a SQL injection vulnerability in a legacy PHP application. The CWE category is CWE-89. The team cannot upgrade the framework because it is end-of-life. What is the most appropriate remediation strategy?

   • ADisable the code scanning rule for SQL injection to reduce noise.
   • BRewrite the affected queries to use parameterized statements.
   • CAdd a comment in the code explaining the risk and mark the alert as false positive.
   • DUpgrade the framework to the latest version even though it is end-of-life.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which format correctly represents a CVE identifier?

   • ACWE-79
   • BGHSA-xxxx-xxxx-xxxx
   • CCVE-2021-44228-A
   • DCVE-2021-44228
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why is asset criticality an important factor in prioritizing vulnerability remediation?

   • ABecause critical assets are easier to patch
   • BBecause critical assets are always public-facing
   • CBecause a vulnerability in a system that handles sensitive data may pose a higher risk to the organization
   • DBecause critical assets are more likely to be exploited
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the first step in the end-to-end remediation workflow after receiving a security alert?

   • AClose the alert without action if it is not critical
   • BImmediately update the dependency to the latest version
   • CNotify all users of the repository about the vulnerability
   • DTriage the alert to assess its validity and impact
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security engineer is handling a critical vulnerability in a production application. The advisory provides a patched version, but the patch requires a database schema migration that could cause downtime. The application is business-critical and cannot be taken offline during business hours. What is the best approach to remediate the vulnerability?

   • ASchedule the patch during a maintenance window and implement a temporary mitigation (e.g., WAF rule) in the meantime.
   • BPatch only the staging environment and leave production vulnerable.
   • CApply the patch immediately, accepting the downtime.
   • DDo not patch because the downtime is unacceptable.
   Reveal Solution Discussion Select an answer first