Perform Vulnerability Management (e.g., Tracking, Triaging, Common Vulnerabilities and Exposures (CVE)) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is closure verification an important part of vulnerability lifecycle management?

   • ATo ensure that the vulnerability is actually resolved and not just marked as fixed
   • BTo notify all users of the vulnerability
   • CTo document the vulnerability for future reference
   • DTo assign a CVE identifier to the vulnerability
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is managing a vulnerability that affects multiple applications. The team has applied a patch to one application, but the patch is not yet available for the other applications. The team needs to report the status to the stakeholders. What is the most appropriate way to report the status?

   • AReport that the vulnerability is still open and no progress has been made.
   • BReport the status of each application separately without an overall summary.
   • CReport that the vulnerability has been resolved because one application has been patched.
   • DReport the overall status, including the number of affected applications, the number patched, and the expected timeline for the remaining applications.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services company's vulnerability scanner identified a critical-severity flaw in a legacy customer-facing web application. The application is scheduled for decommissioning in 60 days, and the vendor no longer provides patches. The security team must decide how to handle this finding while the application remains in production. What should the team do first?

   • AEscalate the finding to the vendor's support team and request an emergency out-of-band patch.
   • BMark the vulnerability as a false positive because the application is being retired soon.
   • CApply a compensating control, such as a web application firewall rule, and document the risk acceptance with a planned retirement date.
   • DImmediately take the application offline until a patch can be obtained from the vendor.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which factor is commonly considered when prioritizing vulnerabilities during triage?

   • AThe exploitability of the vulnerability
   • BThe name of the developer who wrote the code
   • CThe number of lines of code in the affected component
   • DThe color of the vulnerability scanner's interface
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When a vulnerability is mapped to a CVE identifier, what does this enable?

   • AImmediate notification to all affected users
   • BGuaranteed removal of the vulnerability from all systems
   • CAutomatic patching of the vulnerability
   • DStandardized communication about the vulnerability across different organizations
   Reveal Solution Discussion Select an answer first