Vulnerability Management CRISC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following techniques is specifically designed to identify known vulnerabilities in software versions and configurations across an organization's systems?

   • AVulnerability scanning
   • BSecurity awareness training
   • CThreat modeling
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is the vulnerability management process considered continuous?

   • ABecause new vulnerabilities are constantly discovered and systems change over time
   • BBecause vulnerabilities never get fixed
   • CBecause it is mandated by law to run scans every day
   • DBecause it requires daily manual review of all logs
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team has a list of vulnerabilities from a recent scan. They need to decide which to remediate first. The team has limited staff and a 30-day deadline. Which factor should be the primary driver for prioritization?

   • AThe vulnerability's CVSS score, exploitability, and the criticality of the affected asset.
   • BThe number of systems affected, regardless of their importance.
   • CThe ease of patching, prioritizing the easiest fixes first.
   • DThe order in which the vulnerabilities were discovered.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manufacturing company has a legacy SCADA system that cannot be patched without a costly production shutdown. A vulnerability scan identifies a critical remote code execution flaw in the system. The system is isolated on a separate network segment. What is the most appropriate remediation approach?

   • AAccept the risk without any action because the system is isolated.
   • BImplement compensating controls such as network segmentation, strict access controls, and monitoring to reduce the risk.
   • CSchedule a production shutdown as soon as possible to apply the patch, regardless of cost.
   • DReplace the SCADA system immediately with a modern alternative.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team has identified two critical vulnerabilities: one in a public-facing web application that is protected by a WAF, and another in an internal database that is not exposed to the internet but contains sensitive customer data. The team has limited resources to remediate only one this week. Which vulnerability should be prioritized?

   • AThe internal database vulnerability, because the data is sensitive and the WAF reduces the web application's risk.
   • BThe public-facing web application, because it is exposed to the internet.
   • CBoth equally, because both are critical.
   • DNeither, because both have compensating controls.
   Reveal Solution Discussion Select an answer first