Vulnerability and Control Deficiency Analysis CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A vulnerability scan of a hospital's network reveals the following issues: a critical remote code execution vulnerability on a public-facing web server, a high-severity SQL injection flaw in an internal patient records application, and a medium-severity missing security patch on a file server. The hospital has limited IT staff and must prioritize remediation. Which vulnerability should be addressed first?

   • AAll vulnerabilities should be fixed simultaneously to reduce overall risk.
   • BThe critical remote code execution on the public-facing web server
   • CThe medium-severity missing patch on the file server
   • DThe high-severity SQL injection in the internal patient records application
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security manager is planning a vulnerability assessment for a new customer-facing web application. The application is hosted in a cloud environment and uses a mix of open-source components. The manager needs to identify vulnerabilities in the application code and its dependencies. Which combination of techniques would be most effective?

   • AConfiguration review and manual code review
   • BDynamic application security testing (DAST) and network vulnerability scanning
   • CPenetration testing and social engineering
   • DStatic application security testing (SAST) and software composition analysis (SCA)
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Who is the PRIMARY audience for reports on vulnerability status?

   • AExternal auditors only
   • BStakeholders who need to understand the organization's risk posture and remediation progress
   • CThe general public
   • DOnly the security operations team
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a vulnerability assessment, a security analyst discovers that a critical web application has a SQL injection flaw. The application is behind a web application firewall (WAF) that has been configured to block common attack patterns. The analyst also notes that the WAF logs show no blocked SQL injection attempts in the past six months. What is the most likely root cause of this control deficiency?

   • AThe application is not being attacked, so the WAF has nothing to block.
   • BThe vulnerability is a false positive from the scanner.
   • CThe WAF is functioning correctly and blocking all attacks before they reach the application.
   • DThe WAF is not properly configured to detect SQL injection attempts.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security manager at a financial institution is planning the annual vulnerability assessment program. The organization has a mix of legacy mainframe systems, modern cloud workloads, and a large number of IoT devices on the OT network. The mainframe cannot be scanned with active tools without risking outages, and the cloud workloads are ephemeral. Which approach best ensures comprehensive vulnerability identification while minimizing operational impact?

   • APerform only configuration review and manual code review for all systems to avoid any active scanning.
   • BRun authenticated scans on all systems during maintenance windows, including the mainframe, to get the most accurate results.
   • CDeploy a single vulnerability scanner appliance at the network perimeter and scan all systems from that point.
   • DUse passive network monitoring for the mainframe and IoT devices, and agent-based scanning for cloud workloads.
   Reveal Solution Discussion Select an answer first