6.4 - Analyze Test Output and Generate Report CISSP Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   Why is timing important in ethical vulnerability disclosure?

   • AIt allows the vendor to prepare a patch before the vulnerability is widely known
   • BIt ensures the vulnerability is disclosed only during business hours
   • CIt guarantees that the vulnerability will be fixed immediately
   • DIt prevents the vulnerability from being discovered by other researchers
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security assessment identified a vulnerability in a system that is managed by a third-party provider. The provider has a service level agreement (SLA) that requires them to patch vulnerabilities within 30 days. The vulnerability has been open for 45 days. What is the MOST appropriate action?

   • AAccept the risk because the provider is responsible for the system.
   • BRemediate the vulnerability on the provider's system without their approval.
   • CEscalate the issue to the provider's management and enforce the SLA.
   • DTerminate the contract with the provider for breach of SLA.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security assessment of a multinational corporation found a critical remote code execution vulnerability in an internet-facing application. The vulnerability was discovered during a test that was authorized only for the company's internal network. The application is also used by a third-party partner. The security team must decide how to proceed. What is the MOST appropriate action?

   • AIgnore the partner's exposure because the test was only authorized for the internal network.
   • BRemediate the vulnerability internally and then publish a public advisory without mentioning the partner.
   • CDocument the finding, remediate the vulnerability, and coordinate disclosure with the partner through a formal process.
   • DImmediately notify the third-party partner of the vulnerability so they can protect themselves.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security researcher found a vulnerability in a widely used product. The vendor has released a patch, but the researcher believes the patch is incomplete and the vulnerability can still be exploited. What is the MOST appropriate action?

   • APublish the vulnerability details to warn users that the patch is incomplete.
   • BAccept the patch as sufficient and move on.
   • CSell the vulnerability details to a broker to avoid the disclosure dilemma.
   • DContact the vendor privately with evidence that the patch is incomplete and coordinate a follow-up fix.
   Reveal Solution Discussion Select an answer first