Vulnerability and Control Deficiency Analysis CISM Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which vulnerability assessment technique is MOST appropriate for identifying missing security patches on a large number of servers?

   • ACode review
   • BAutomated vulnerability scanning
   • CSocial engineering assessment
   • DManual penetration testing
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following BEST describes the primary purpose of vulnerability identification in an information security program?

   • ATo enumerate all potential weaknesses in systems and assets that could be exploited by threats
   • BTo determine the likelihood that a specific threat will occur
   • CTo implement security controls that eliminate all known vulnerabilities
   • DTo assign a monetary value to each asset based on its replacement cost
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security manager is planning a vulnerability assessment for a critical industrial control system (ICS) environment. The environment includes legacy PLCs that cannot tolerate active scanning, and the network is segmented from the corporate network. The manager needs to identify vulnerabilities without disrupting operations. Which technique is most appropriate?

   • AAgent-based scanning installed on each PLC.
   • BPenetration testing of the ICS environment from the corporate network.
   • CPassive network monitoring and review of vendor security advisories.
   • DActive vulnerability scanning with a tool that supports ICS protocols.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is conducting a vulnerability assessment of a new web application. The analyst has already performed an authenticated scan and found several vulnerabilities. To gain a deeper understanding of the exploitability and business impact, what should the analyst do next?

   • ARun another automated scan with a different tool to confirm the findings.
   • BReview the application's source code to find additional vulnerabilities.
   • CPerform a manual penetration test to validate the findings and assess exploitability.
   • DImmediately patch all identified vulnerabilities without further analysis.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security manager discovers that a critical server has been missing security patches for several months, despite a policy requiring monthly patching. The patch management team states that they have been applying patches, but the server still shows missing patches. What is the most likely root cause of this control deficiency?

   • AThe patch management team is not following the policy.
   • BThe server's operating system is not supported by the patch management tool.
   • CThe server is not included in the patch management system's scope.
   • DThe server is a virtual machine that is not connected to the network.
   Reveal Solution Discussion Select an answer first