Perform Vulnerability Management (e.g., Tracking, Triaging, Common Vulnerabilities and Exposures (CVE)) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a vulnerability in a custom application. The analyst suspects the vulnerability is similar to a known CVE but is not certain. The analyst wants to determine if the vulnerability is a new variant or the same as the known CVE. What is the most appropriate action?

   • ACompare the vulnerability's characteristics, such as the affected component and attack vector, with the known CVE's details.
   • BIgnore the known CVE and treat the vulnerability as a new, unique issue.
   • CCreate a new CVE identifier for the vulnerability immediately.
   • DReport the vulnerability as the same as the known CVE without further investigation.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team has identified a critical vulnerability in a legacy application that is no longer supported by the vendor. The application is business-critical and cannot be taken offline. The team has implemented a compensating control, but the vulnerability remains. What is the most appropriate long-term remediation strategy?

   • APlan to replace the legacy application with a supported alternative and document the risk acceptance until the replacement is complete.
   • BAttempt to obtain the source code and patch the application internally.
   • CTake the application offline until a patch is available.
   • DContinue to apply compensating controls and monitor the vulnerability indefinitely.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team has been tracking a critical vulnerability in a customer-facing application for several weeks. The patch is scheduled to be applied next week, but the vulnerability was recently exploited in the wild. The team needs to communicate the status to senior management. What should the team report?

   • AThe vulnerability is being tracked, the patch is scheduled, and the exploitation in the wild increases the urgency of the remediation.
   • BThe vulnerability is a low risk and does not require immediate attention.
   • CThe vulnerability is critical and the team is working on it, but no specific timeline is available.
   • DThe vulnerability has been patched and the issue is resolved.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A vulnerability management team has applied a patch to a production server and confirmed the vulnerability is no longer present. According to the vulnerability lifecycle management process, what is the final step before closing the vulnerability record?

   • ADelete the vulnerability record from the tracking system to keep the database clean.
   • BImmediately move on to the next vulnerability without updating the tracking system.
   • CDocument the remediation actions taken and the verification results in the vulnerability tracking system.
   • DNotify the system owner that the vulnerability has been resolved and no further action is needed.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A vulnerability management team is reviewing a vulnerability that was remediated three months ago. The team wants to verify that the remediation is still effective. What is the most appropriate action?

   • AClose the vulnerability record because it was remediated three months ago.
   • BReview the original remediation documentation and assume the vulnerability is still resolved.
   • CRun a vulnerability scan to confirm the vulnerability is still not present in the environment.
   • DWait for the next scheduled vulnerability scan to check the status.
   Reveal Solution Discussion Select an answer first