Vulnerability Management CRISC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company has a critical vulnerability in a legacy application that is end-of-life and cannot be patched. The application is essential for business operations. The risk team has proposed several options. Which option best balances risk reduction and business continuity?

   • AIsolate the application on a separate network segment and implement strict access controls and monitoring.
   • BAccept the risk without any mitigation because the application is essential.
   • CDecommission the application immediately and migrate to a modern alternative.
   • DApply a virtual patch using a third-party tool that does not require a reboot.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   During vulnerability analysis, what is the primary purpose of determining the Common Vulnerability Scoring System (CVSS) score of a vulnerability?

   • ATo quantify the severity of the vulnerability
   • BTo list all affected systems in the organization
   • CTo identify the vendor responsible for the vulnerability
   • DTo determine the exact patch version needed
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has a vulnerability management program that includes quarterly scans and manual patching. After a security incident, they realize that a known vulnerability was not patched because it was missed in the scan. What is the most important improvement to the program?

   • AUse a different scanning tool that reports fewer false positives.
   • BReduce the scope of scans to focus on critical assets only.
   • CFocus on manual patching to ensure accuracy.
   • DIncrease the frequency of scans and automate patch management where possible.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following best describes the vulnerability management lifecycle?

   • AA process that ends after reporting
   • BA continuous process of identifying, analyzing, prioritizing, remediating, and reporting vulnerabilities
   • CA one-time assessment performed annually
   • DA process that only involves patching
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a critical vulnerability in a custom application. The vendor has released a patch, but the patch is known to cause compatibility issues with another application. The security team must decide how to proceed. What is the best approach?

   • ADeploy the patch immediately to all systems to reduce risk.
   • BDo not apply the patch and accept the risk.
   • CApply the patch only to systems that do not use the other application.
   • DTest the patch in a staging environment that mirrors production, then deploy if no issues are found.
   Reveal Solution Discussion Select an answer first