Vulnerability Management CRISC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A retail company has a mature vulnerability management program. After a recent patch cycle, the security team wants to ensure that all critical vulnerabilities have been remediated and that no new vulnerabilities have been introduced. What is the most appropriate next step?

   • AConduct a verification scan to confirm remediation and check for new vulnerabilities.
   • BClose all vulnerability tickets without further verification to save time.
   • CRely on the patch management system's report to confirm all patches were applied.
   • DWait for the next scheduled scan to verify remediation.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A vulnerability scan of a web server identifies a medium-severity vulnerability in an outdated library. The library is used only in a non-critical internal tool that is not internet-facing. The security team has limited resources. What should they do with this finding?

   • AIgnore the finding because the tool is internal and not internet-facing.
   • BAnalyze the exploitability and business impact, then deprioritize it in favor of higher-risk vulnerabilities.
   • CImmediately patch the library without further analysis.
   • DTreat it as a critical vulnerability because it is a medium severity.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An organization needs to identify vulnerabilities in a custom-built web application. Which assessment technique is most appropriate for this purpose?

   • AConfiguration compliance scanning
   • BWeb application vulnerability scanning
   • CNetwork port scanning
   • DPatch management verification
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to establish a vulnerability management program. They have a mix of cloud and on-premises assets, including containers and serverless functions. What is the most important consideration for vulnerability identification?

   • APerform scans only when new assets are deployed.
   • BFocus only on internet-facing assets to reduce noise.
   • CEnsure that scanning techniques cover all asset types, including containers and serverless functions.
   • DUse a single scanning tool for all assets to simplify management.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When a patch for a vulnerability is not yet available, which of the following is an example of a compensating control?

   • ADocumenting the vulnerability in the risk register
   • BImplementing an intrusion prevention system (IPS) rule to block exploit attempts
   • CDisabling the vulnerability scanner
   • DWaiting for the patch to be released
   Reveal Solution Discussion Select an answer first