In the vulnerability management lifecycle, what is the primary role of remediation?

To identify new vulnerabilities through continuous scanning.

To assign severity scores to vulnerabilities based on CVSS.

To communicate risks to executive management.

To reduce the risk posed by vulnerabilities by eliminating or mitigating them.

A critical vulnerability is found in a legacy application that is no longer supported by the vendor, so no patch is available. The application is essential for business operations and cannot be decommissioned. The security team must reduce the risk. Which approach is the most appropriate?

Apply a patch from a similar application that has a similar vulnerability.

Implement compensating controls, such as network segmentation and strict access controls, and document the residual risk.

Replace the application with an open-source alternative that is actively maintained.

Disable the application until a patch becomes available.

Which action is part of remediation verification?

Creating a new remediation plan for the next quarter.

Updating the vulnerability database with new signatures.

Notifying stakeholders about the vulnerability.

Re-scanning the affected system to confirm the vulnerability is gone.

What should be included in a remediation report?

A list of all vulnerabilities that were remediated and the residual risk.

The exact CVSS scores of all vulnerabilities in the environment.

The vendor's patch release notes for every patch applied.

The names of all employees who were involved in the remediation.

What is the purpose of a remediation plan?

To document all vulnerabilities found in the environment.

To track the number of vulnerabilities over time.

To outline the steps and priorities for fixing vulnerabilities based on risk and resources.

To assign CVSS scores to each vulnerability.

Certified Cybersecurity Operations Analyst

Domain 5Objective 7

Vulnerability Remediation CCOA Practice Questions (Page 2)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

11%of the exam

Questions 6–10

6foundation · easy
In the vulnerability management lifecycle, what is the primary role of remediation?
Select an answer first
7expert · hard
A critical vulnerability is found in a legacy application that is no longer supported by the vendor, so no patch is available. The application is essential for business operations and cannot be decommissioned. The security team must reduce the risk. Which approach is the most appropriate?
Select an answer first
8foundation · easy
Which action is part of remediation verification?
Select an answer first
9foundation · easy
What should be included in a remediation report?
Select an answer first
10foundation · easy
What is the purpose of a remediation plan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.