Vulnerability Management CRISC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of vulnerability reporting to stakeholders?

   • ATo communicate findings and remediation status in a clear and actionable manner
   • BTo satisfy regulatory requirements only
   • CTo replace the need for technical remediation
   • DTo assign blame for security failures
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In vulnerability analysis, what does the 'exploitability' of a vulnerability primarily indicate?

   • AThe likelihood that the vulnerability can be successfully exploited
   • BThe number of systems affected by the vulnerability
   • CThe date the vulnerability was discovered
   • DThe cost of remediating the vulnerability
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is reviewing a vulnerability scan report. The report lists a critical vulnerability in a web server that is exposed to the internet. However, the analyst knows that the web server is a honeypot designed to attract attackers. How should the analyst handle this finding?

   • AReport the vulnerability as a false positive to the management.
   • BTreat the honeypot as a critical asset and patch it immediately.
   • CDocument the honeypot's purpose and exclude it from the remediation process, but continue to monitor it.
   • DRemove the honeypot from the network to eliminate the risk.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following best describes the purpose of vulnerability prioritization?

   • ATo patch all vulnerabilities immediately
   • BTo report vulnerabilities to management
   • CTo rank vulnerabilities based on risk to guide remediation efforts
   • DTo identify all vulnerabilities in the environment
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A vulnerability scan of a financial services firm flags a critical-severity SQL injection in a legacy customer-facing web application and a high-severity TLS misconfiguration on an internal admin portal. The legacy app cannot be patched for 60 days due to vendor constraints. The risk team must decide remediation priorities. What should they do first?

   • AApply a compensating control, such as a web application firewall rule, to the legacy app and schedule the TLS fix for the next maintenance window.
   • BReport both findings to management and wait for a decision before taking any action.
   • CShut down the legacy web application until a vendor patch is available to eliminate the risk entirely.
   • DPatch the internal admin portal first because it is easier and faster, then address the legacy app when the vendor releases a patch.
   Reveal Solution Discussion Select an answer first