Vulnerability and Control Deficiency Analysis CISM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a remediation plan?

   • ATo satisfy regulatory requirements without taking action
   • BTo provide a historical record of past security incidents
   • CTo document the steps and resources needed to address identified vulnerabilities and control deficiencies
   • DTo assign blame for the existence of the vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After implementing a remediation plan, the security manager wants to ensure that the fixes are effective and that no new vulnerabilities have been introduced. What is the most appropriate action?

   • AReview the patch management logs to confirm that patches were applied.
   • BConduct a follow-up vulnerability scan and compare results with the baseline.
   • CAsk the IT team to confirm that the fixes were implemented.
   • DWait for the next scheduled annual scan to see if the vulnerabilities are gone.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary goal of control deficiency analysis?

   • ATo identify the root cause of a control failure and assess its potential impact on risk
   • BTo document all security incidents that have occurred in the past year
   • CTo assign a risk score to every vulnerability in the environment
   • DTo immediately implement a new control to replace the deficient one
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of monitoring the effectiveness of remediation efforts?

   • ATo identify new threats that may emerge in the future
   • BTo assign a risk score to each vulnerability
   • CTo verify that vulnerabilities have been properly mitigated and remain mitigated over time
   • DTo document the cost of remediation activities
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security manager has a limited budget and must prioritize remediation of vulnerabilities across the organization. The following vulnerabilities have been identified: a critical vulnerability in a public-facing web server that is actively exploited in the wild, a high-severity vulnerability in an internal HR system that is not exposed to the internet, and a medium-severity vulnerability in a file server that contains sensitive data but is only accessible internally. The web server is not critical to business operations, but the HR system is. Which vulnerability should be remediated first?

   • AThe high-severity vulnerability in the internal HR system
   • BThe critical vulnerability in the public-facing web server
   • CThe medium-severity vulnerability in the file server
   • DAll three vulnerabilities should be remediated simultaneously to reduce overall risk.
   Reveal Solution Discussion Select an answer first