7.8 - Implement and Support Patch and Vulnerability Management CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is it important to integrate patch management with formal change management processes?

   • ATo increase the number of patches deployed
   • BTo ensure patches are tested and approved before deployment
   • CTo speed up the patching process
   • DTo eliminate the need for vulnerability scanning
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is orchestration in the context of patch and vulnerability management?

   • ADeleting unused software
   • BCreating a list of vulnerabilities
   • CCoordinating multiple automated tasks to work together
   • DManually applying patches to each system
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A compliance auditor requires evidence that the organization is managing vulnerabilities effectively. Which set of documentation best demonstrates a mature vulnerability management program?

   • AA log of all vulnerability scans and the raw output from each scan.
   • BA summary of the vulnerability management policy and a list of open vulnerabilities.
   • CA report showing the number of vulnerabilities identified and remediated each month.
   • DA dashboard showing vulnerability metrics, remediation timelines, and evidence of verification for closed vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is conducting a vulnerability assessment of a new web application. The team has limited time and must choose between an authenticated scan and an unauthenticated scan. The application has a login page that requires credentials. Which scan should the team perform to get the most accurate results?

   • AAuthenticated scan with valid credentials.
   • BUnauthenticated scan to simulate an external attacker.
   • CBoth scans, but start with the unauthenticated scan.
   • DNeither scan; use manual penetration testing instead.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A patch management team needs to deploy a critical patch to a system that is part of a compliance-regulated environment. The change management policy requires a two-week notice for all changes. The patch is urgent and must be deployed within 48 hours. What should the team do?

   • ARequest an emergency change approval from the CAB, explaining the urgency and risk.
   • BDeploy the patch without approval because it is critical.
   • CWait for the two-week notice period to expire before deploying the patch.
   • DDeploy the patch immediately and document the decision after the fact.
   Reveal Solution Discussion Select an answer first