Vulnerability Management CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a key characteristic of an effective vulnerability report?

   • AIt is published only after all vulnerabilities are fixed
   • BIt contains only the vulnerabilities that have a patch
   • CIt includes every technical detail for all audiences
   • DIt is tailored to the audience's needs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a vulnerability scan, the security team identifies a critical vulnerability in a customer-facing application. The team has prepared a detailed technical report. The executive steering committee needs to understand the business risk and required actions. What is the best way to communicate this finding?

   • AWait until the vulnerability is fixed before reporting it to avoid alarming the committee.
   • BSend the full technical report to the committee so they have all the details.
   • CProvide a high-level summary that explains the business impact, likelihood of exploitation, and recommended remediation timeline.
   • DOnly inform the IT manager and let them decide what to escalate.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a vulnerability management program that relies on annual penetration tests and ad-hoc scans. After a breach, they find that a vulnerability was present for months. The company wants to improve its program. What is the most important change?

   • AImplement continuous vulnerability scanning and integrate findings into the remediation workflow.
   • BPurchase a more expensive scanning tool.
   • CIncrease the frequency of penetration tests to quarterly.
   • DFocus on manual code reviews for all applications.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A security team is prioritizing vulnerabilities for remediation. They have identified the following vulnerabilities. Which factors should they consider when prioritizing? (Select all that apply.)

   • AThe number of systems affected by each vulnerability.
   • BThe criticality of the assets affected.
   • CThe availability of a patch for each vulnerability.
   • DThe ease of exploitation of each vulnerability.
   • EThe CVSS score of each vulnerability.
   Check answers Discussion Select an answer first
6. 5expert · hard

   A vulnerability management team has identified a critical vulnerability in a third-party component used by multiple applications. The vendor has not yet released a patch. The team needs to communicate this to the application owners. What is the most effective approach?

   • AInform application owners of the vulnerability, its potential impact, and interim mitigation measures while awaiting the vendor patch.
   • BTell application owners to stop using the component immediately.
   • COnly inform senior management and let them decide what to tell application owners.
   • DWait until the vendor patch is available before informing application owners.
   Reveal Solution Discussion Select an answer first