Vulnerability and Control Deficiency Analysis CISM Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   Which of the following is a key component of an effective remediation plan?

   • AA description of the threat actors who might exploit the vulnerabilities
   • BA list of all vulnerabilities ever discovered in the organization
   • CA guarantee that all vulnerabilities will be fixed immediately
   • DClear assignment of responsibility for each remediation action
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security manager is planning a vulnerability assessment for a new cloud-based application that uses serverless functions and managed databases. The application is deployed in a DevOps environment with frequent changes. Which assessment approach is most appropriate?

   • AUse only network vulnerability scanning of the cloud environment.
   • BRely on the cloud provider's security assessments and do not perform any internal testing.
   • CPerform a single annual penetration test of the application.
   • DIntegrate vulnerability scanning into the CI/CD pipeline and use cloud-native scanning tools.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A security manager has implemented a vulnerability remediation program and needs to report to senior management on its effectiveness. The manager has the following data: the number of vulnerabilities identified, the number remediated, the average time to remediate, and the number of vulnerabilities that remain open. Which metric would be most meaningful to senior management to demonstrate the program's success?

   • AThe number of vulnerabilities that remain open.
   • BThe percentage of critical vulnerabilities remediated within the target timeframe.
   • CThe average time to remediate all vulnerabilities.
   • DThe total number of vulnerabilities identified.
   Reveal Solution Discussion Select an answer first