A vulnerability scan reveals a high-severity vulnerability in a custom application that is critical to business operations. The vendor has not yet released a patch. What is the most appropriate remediation strategy?

Disable the application until the vendor releases a patch

Accept the risk and continue operations without any mitigation

Uninstall the application and replace it with a different product

Apply a virtual patch using a web application firewall or intrusion prevention system

Which of the following is a common remediation strategy for a software vulnerability?

Ignoring the vulnerability until a breach occurs

Applying a vendor-provided security patch

A vulnerability assessment report is being prepared for a client. The client's management team wants a summary of the top risks, while the technical team needs detailed remediation steps. The analyst has limited time and must produce a single report. What is the best approach?

Write a single report with an executive summary at the beginning and detailed technical sections in the appendix

Write two separate reports, one for management and one for the technical team

Write a report that focuses only on the executive summary for management

Write a report that focuses only on the technical details for the IT team

A vulnerability scan reveals a critical vulnerability in a third-party application used by the finance department. The vendor has released a patch, but the finance team is concerned about downtime and potential data loss. The analyst must coordinate remediation. What should the analyst do first?

Document the vulnerability and defer remediation indefinitely

Disable the application until the patch is applied

Schedule a maintenance window with the finance team and test the patch in a staging environment

Apply the patch immediately to all affected systems

Certified Cybersecurity Operations Analyst

Domain 5Objective 5

Vulnerability Assessment CCOA Practice Questions (Page 2)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

11%of the exam

Questions 6–10

6application · medium
A vulnerability scan reveals a high-severity vulnerability in a custom application that is critical to business operations. The vendor has not yet released a patch. What is the most appropriate remediation strategy?
Select an answer first
7foundation · easy
Which of the following is a common remediation strategy for a software vulnerability?
Select an answer first
8expert · hard
A vulnerability assessment report is being prepared for a client. The client's management team wants a summary of the top risks, while the technical team needs detailed remediation steps. The analyst has limited time and must produce a single report. What is the best approach?
Select an answer first
9foundation · easy
Which open-source tool is commonly used to perform network vulnerability scanning and is often integrated into security distributions like Kali Linux?
Select an answer first
10application · medium
A vulnerability scan reveals a critical vulnerability in a third-party application used by the finance department. The vendor has released a patch, but the finance team is concerned about downtime and potential data loss. The analyst must coordinate remediation. What should the analyst do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.