Vulnerability and Control Deficiency Analysis CISM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which vulnerability assessment technique involves actively attempting to exploit a vulnerability to determine its real-world impact?

   • AConfiguration review
   • BLog review
   • CPenetration testing
   • DNetwork mapping
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security manager is developing a remediation plan for a critical vulnerability in a legacy application that is essential for business operations. The vendor has released a patch, but the patch requires a database upgrade that could cause downtime and is not fully tested. The organization has a maintenance window of only four hours on weekends. What should the manager do?

   • AApply the patch in the next maintenance window and test the database upgrade in a staging environment first.
   • BApply the patch during business hours to get it done faster.
   • CApply the patch immediately without testing to reduce the risk of exploitation.
   • DDo not apply the patch and rely on compensating controls.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which factor is MOST important when prioritizing vulnerabilities for remediation?

   • AThe ease of remediation
   • BThe risk posed by the vulnerability to the organization
   • CThe number of vulnerabilities found in a single system
   • DThe age of the vulnerability
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A vulnerability exists on a server that contains highly sensitive customer data. The vulnerability is known to be actively exploited in the wild. How should this vulnerability be prioritized?

   • AMedium priority because the vulnerability is not yet exploited in this environment
   • BHigh priority because of the high asset criticality and active exploitation
   • CDefer remediation until the next scheduled maintenance window
   • DLow priority because the vulnerability is already known
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security manager is developing a remediation plan for a set of vulnerabilities found in a web application. The application is scheduled for a major upgrade in six months. Some vulnerabilities can be fixed by configuration changes, while others require code changes. What should the manager include in the remediation plan?

   • AWait for the upgrade and fix all vulnerabilities at that time.
   • BApply configuration fixes immediately and schedule code fixes for the upgrade.
   • COnly fix the critical vulnerabilities and ignore the rest.
   • DApply all fixes immediately, including code changes, without waiting for the upgrade.
   Reveal Solution Discussion Select an answer first