Perform Vulnerability Management (e.g., Tracking, Triaging, Common Vulnerabilities and Exposures (CVE)) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a remediation action?

   • ARunning a vulnerability scanner
   • BApplying a security patch provided by the vendor
   • CCreating a CVE entry
   • DRecording the vulnerability in a tracking system
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a key feature of an effective vulnerability tracking system?

   • AIt maintains a status history for each vulnerability
   • BIt deletes vulnerabilities once they are reported
   • CIt automatically exploits vulnerabilities to verify their impact
   • DIt only tracks vulnerabilities found in production
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is triaging two vulnerabilities. Vulnerability A is a critical-severity vulnerability in an internet-facing application with a known exploit, but the patch is complex and requires a full application restart. Vulnerability B is a high-severity vulnerability in an internal application with no known exploit, and the patch is simple and can be applied without downtime. The team has limited resources and can only remediate one vulnerability this week. Which vulnerability should the team prioritize?

   • AVulnerability A, because it is critical severity and has a known exploit, despite the complex patch.
   • BVulnerability B, because the patch is simple and can be applied without downtime.
   • CNeither vulnerability, and wait for more information.
   • DBoth vulnerabilities, by splitting the team's resources.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team has identified a vulnerability in a custom application. The vendor has released a patch, but the patch is known to cause performance issues in the application. The team needs to remediate the vulnerability without degrading performance. What is the most appropriate approach?

   • AApply the patch directly to production and monitor for performance issues.
   • BDo not apply the patch and accept the risk of the vulnerability.
   • CApply a workaround that mitigates the vulnerability without the performance impact.
   • DApply the patch in a staging environment, test the performance impact, and then deploy to production if acceptable.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is timely vulnerability reporting to stakeholders important?

   • ATo automatically fix vulnerabilities
   • BTo replace the need for vulnerability scanning
   • CTo avoid legal liability
   • DTo allow stakeholders to make informed decisions about risk acceptance and remediation
   Reveal Solution Discussion Select an answer first