What is the primary principle of responsible disclosure of a vulnerability?

Keeping the vulnerability secret indefinitely

Selling the vulnerability to the highest bidder

Publishing the vulnerability immediately to alert all users

Coordinating with the vendor to allow time for a fix before public release

What is the primary purpose of a formal exception process in security assessment and testing?

To document and approve cases where a security requirement cannot be met immediately

To bypass security controls without any oversight

To permanently waive compliance requirements

To automatically extend all remediation deadlines

A security team discovered a critical vulnerability in a system that is owned by a third-party vendor. The vendor has a contractual obligation to patch the system, but has not done so after 30 days. The system is internet-facing and contains sensitive customer data. What is the MOST appropriate action?

Escalate the issue to senior management and the vendor's management, and implement compensating controls.

Terminate the contract with the vendor immediately.

Remediate the vulnerability on the vendor's system without their approval.

Accept the risk because the vendor is responsible for the system.

A security team discovered a vulnerability in a system that is owned by a different department. The department has not responded to multiple requests to remediate the issue. What is the MOST appropriate action for the security team?

Ignore the vulnerability because the system is not owned by the security team.

Document the issue and formally request an exception or remediation plan from the department.

Escalate the issue to senior management to enforce remediation.

Remediate the vulnerability without the department's approval.

During a vulnerability assessment, a security analyst identifies several findings. Which action best describes the purpose of remediation prioritization?

Reporting findings only to the technical team without management involvement

Deferring all remediation until the next scheduled maintenance window

Fixing all findings in the order they were discovered to ensure completeness

Assigning a risk rating to each finding and addressing the highest-risk items first

Certified Information Systems Security Professional

Domain 6Objective 4

6.4 - Analyze Test Output and Generate Report CISSP Practice Questions (Page 3)

Part of the Security Assessment and Testing domain, which accounts for 12% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 2–3 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

12%of the exam

Questions 11–15

11foundation · easy
What is the primary principle of responsible disclosure of a vulnerability?
Select an answer first
12foundation · easy
What is the primary purpose of a formal exception process in security assessment and testing?
Select an answer first
13expert · hard
A security team discovered a critical vulnerability in a system that is owned by a third-party vendor. The vendor has a contractual obligation to patch the system, but has not done so after 30 days. The system is internet-facing and contains sensitive customer data. What is the MOST appropriate action?
Select an answer first
14application · medium
A security team discovered a vulnerability in a system that is owned by a different department. The department has not responded to multiple requests to remediate the issue. What is the MOST appropriate action for the security team?
Select an answer first
15foundation · easy
During a vulnerability assessment, a security analyst identifies several findings. Which action best describes the purpose of remediation prioritization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.