A vulnerability management team has been tracking a vulnerability for several months. The vulnerability was remediated in the production environment, but the team has not yet closed the record. What is the most likely reason the record should remain open?

The vulnerability was not actually present in the production environment.

The team forgot to close the record.

The vulnerability is a false positive and should have been closed immediately.

The remediation has not been verified in all affected environments.

What is the primary goal of vulnerability triage?

To assign a CVE identifier to each vulnerability

To eliminate all vulnerabilities from the system

To automatically patch all vulnerabilities immediately

To prioritize vulnerabilities based on severity, exploitability, and business impact

What is the primary purpose of a vulnerability tracking system in secure software deployment?

To replace the need for manual security testing

To provide a public database of known vulnerabilities

To record, monitor, and manage identified vulnerabilities throughout their lifecycle

To automatically apply security patches to production systems

What is the purpose of a CVE identifier?

To automatically fix the vulnerability

To provide a standardized reference for a specific vulnerability

To replace the need for vulnerability scanning

To rank vulnerabilities by severity

A security analyst discovers a vulnerability in a third-party library used by multiple internal applications. The analyst needs to track the vulnerability across all affected applications. What is the most effective approach?

Create a separate vulnerability record for each affected application.

Create a single vulnerability record in the tracking system and link it to all affected applications.

Wait until the vendor releases a patch before creating any tracking records.

Track the vulnerability in a spreadsheet and email updates to the application owners.

Certified Secure Software Lifecycle Professional

Domain 7Objective 10

Perform Vulnerability Management (e.g., Tracking, Triaging, Common Vulnerabilities and Exposures (CVE)) CSSLP Practice Questions (Page 1)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

11%of the exam

Questions 1–5

1application · medium
A vulnerability management team has been tracking a vulnerability for several months. The vulnerability was remediated in the production environment, but the team has not yet closed the record. What is the most likely reason the record should remain open?
Select an answer first
2foundation · easy
What is the primary goal of vulnerability triage?
Select an answer first
3foundation · easy
What is the primary purpose of a vulnerability tracking system in secure software deployment?
Select an answer first
4foundation · easy
What is the purpose of a CVE identifier?
Select an answer first
5application · medium
A security analyst discovers a vulnerability in a third-party library used by multiple internal applications. The analyst needs to track the vulnerability across all affected applications. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.