A security researcher found a critical vulnerability in a popular software product. The vendor has been unresponsive for 90 days despite multiple private notifications. The researcher is considering public disclosure. What is the MOST appropriate action?

Publish the full technical details immediately to force the vendor to act.

Sell the vulnerability to a broker to avoid the disclosure dilemma.

Continue to wait indefinitely for the vendor to respond.

Publish a limited advisory without exploit details, and provide the vendor a final deadline for a patch.

A security assessment identified multiple vulnerabilities in a web application. The application owner wants to fix all issues in the next release, which is scheduled in 60 days. However, one of the vulnerabilities is a critical SQL injection that is actively being exploited. What is the MOST appropriate action?

Disable the web application until all vulnerabilities are fixed.

Deploy an emergency fix for the SQL injection and schedule the remaining fixes for the next release.

Wait for the next release to fix all vulnerabilities together to minimize disruption.

Request a formal exception for the SQL injection and accept the risk for 60 days.

A security assessment found a vulnerability in a system that is scheduled for decommissioning in 6 months. The system is not internet-facing and contains no sensitive data. What is the MOST appropriate action?

Disconnect the system from the network to eliminate the risk.

Request a formal exception for the vulnerability with a review date aligned with the decommission date.

Remediate the vulnerability immediately to ensure the system is secure.

Ignore the vulnerability because the system will be decommissioned soon.

After a remediation effort, what is the primary purpose of verifying that fixes are implemented effectively?

To confirm that the vulnerability is actually mitigated and no new issues were introduced

To document the remediation for compliance purposes only

To assign a new risk rating to the vulnerability

To determine who is responsible for the vulnerability

A penetration tester discovered a vulnerability in a third-party vendor's product during an authorized test. The vendor has a public bug bounty program. What is the MOST appropriate action for the tester?

Publish the vulnerability details on a public forum to warn other users.

Keep the vulnerability secret and only inform the client that authorized the test.

Report the vulnerability to the vendor through their bug bounty program and coordinate disclosure.

Sell the vulnerability to a third-party broker for financial gain.

Certified Information Systems Security Professional

Domain 6Objective 4

6.4 - Analyze Test Output and Generate Report CISSP Practice Questions (Page 2)

Part of the Security Assessment and Testing domain, which accounts for 12% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

12%of the exam

Questions 6–10

6expert · hard
A security researcher found a critical vulnerability in a popular software product. The vendor has been unresponsive for 90 days despite multiple private notifications. The researcher is considering public disclosure. What is the MOST appropriate action?
Select an answer first
7expert · hard
A security assessment identified multiple vulnerabilities in a web application. The application owner wants to fix all issues in the next release, which is scheduled in 60 days. However, one of the vulnerabilities is a critical SQL injection that is actively being exploited. What is the MOST appropriate action?
Select an answer first
8application · medium
A security assessment found a vulnerability in a system that is scheduled for decommissioning in 6 months. The system is not internet-facing and contains no sensitive data. What is the MOST appropriate action?
Select an answer first
9foundation · easy
After a remediation effort, what is the primary purpose of verifying that fixes are implemented effectively?
Select an answer first
10application · medium
A penetration tester discovered a vulnerability in a third-party vendor's product during an authorized test. The vendor has a public bug bounty program. What is the MOST appropriate action for the tester?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.