Vulnerability Management CRISC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When prioritizing vulnerabilities for remediation, which factor should be considered alongside the technical severity of the vulnerability?

   • AThe color of the vulnerability scanner's report
   • BThe business impact on affected systems
   • CThe number of characters in the vulnerability description
   • DThe name of the vulnerability scanner vendor
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A vulnerability scan identifies a critical vulnerability in a database server that is part of a payment processing system. The patch requires a reboot, which will cause a brief outage. The system is expected to be highly available. What is the most appropriate remediation approach?

   • AApply the patch immediately without notifying stakeholders to minimize risk.
   • BApply a compensating control instead of patching to avoid the outage.
   • CSchedule the patch during a planned maintenance window and communicate the outage to stakeholders.
   • DDo not patch the server because the outage is unacceptable.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common remediation action for a software vulnerability?

   • AChanging the system's hostname
   • BDeleting the vulnerability scan report
   • CApplying a vendor-provided patch
   • DIncreasing the logging level
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A vulnerability management team has completed a remediation cycle. They need to report to the board of directors on the effectiveness of the program. Which metric would be most meaningful to the board?

   • AThe number of scanning tools used in the program.
   • BThe percentage of critical vulnerabilities remediated within the agreed SLA.
   • CThe total number of vulnerabilities discovered during the last scan.
   • DThe average time to patch a vulnerability.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A vulnerability scan identifies a high-severity vulnerability in a web application. The application is behind a firewall that blocks all inbound traffic except HTTP/HTTPS. The vulnerability is a buffer overflow in the application's file upload feature. What is the most important factor in analyzing this vulnerability?

   • AThe age of the vulnerability.
   • BThe severity score of the vulnerability.
   • CThe firewall's ability to block the attack.
   • DThe exploitability of the buffer overflow through the file upload feature, given the firewall allows HTTP/HTTPS.
   Reveal Solution Discussion Select an answer first