Vulnerability and Control Deficiency Analysis CISM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a major vulnerability remediation effort, the security manager needs to report progress to the board of directors. Which type of metric would be most useful for the board to understand the effectiveness of the remediation program?

   • APercentage of critical vulnerabilities remediated within the agreed timeframe
   • BTotal number of vulnerabilities identified since the program began
   • CNumber of vulnerability scans performed in the last quarter
   • DAverage time to patch a vulnerability in the IT department
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security manager has identified a critical vulnerability in a legacy application that cannot be patched immediately because the vendor no longer provides updates. The application is essential for business operations. What should the manager include in the remediation plan?

   • ARemove the application from the network until a patch is available.
   • BIgnore the vulnerability because the vendor has not released a patch.
   • CImplement compensating controls and document the residual risk.
   • DDeploy the vendor's latest version, even if it is not fully tested.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During a control deficiency analysis, which of the following is the MOST important factor to consider when determining the potential impact of a deficiency?

   • AThe age of the control documentation
   • BThe cost of the control that failed
   • CThe criticality of the assets that the control is designed to protect
   • DThe number of employees in the organization
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security manager is investigating a data breach that occurred through a known vulnerability in a web server. The vulnerability had been identified in a scan six months ago, but it was not remediated because the IT team claimed that the server was not critical and the vulnerability was low risk. The server was later exposed to the internet due to a network configuration change. What is the primary control deficiency that allowed this breach?

   • AThe IT team did not apply the patch because they were lazy.
   • BThe vulnerability management process did not account for changes in asset exposure.
   • CThe network configuration change was not authorized.
   • DThe vulnerability scan was not accurate enough.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a vulnerability in an information system?

   • AThe potential financial loss if a database is breached
   • BA firewall rule that allows inbound traffic on port 22 from any source
   • CA threat actor using a phishing email to trick an employee
   • DThe likelihood that a natural disaster will damage a data center
   Reveal Solution Discussion Select an answer first