Which of the following is a related source that can supplement CVE data for assessing vulnerability relevance?

The company's marketing materials

What should a vulnerability report to stakeholders include?

The status and remediation progress of vulnerabilities

The exact exploit code for the vulnerability

The source code of the affected application

The names of all developers who worked on the code

What does vulnerability lifecycle management encompass?

Only the patching of vulnerabilities

Only the initial discovery of vulnerabilities

Only the reporting of vulnerabilities to management

Managing vulnerabilities from discovery through resolution, including documentation and closure verification

A security team is reviewing a CVE for a vulnerability in a widely used open-source library. The CVE description mentions that the vulnerability is only exploitable if the library is used in a specific configuration. The team's applications use the library in a different configuration. What should the team do?

Ignore the CVE because the library is widely used and the vulnerability is likely not serious.

Assess whether the team's specific usage of the library makes the vulnerability exploitable, and document the findings.

Immediately patch all applications using the library, regardless of the configuration.

Report the CVE as a false positive because the team's configuration is different.

A security analyst discovers a new vulnerability in a custom-built internal application. The analyst wants to determine if this vulnerability is already known and publicly documented. Which action should the analyst take to identify the vulnerability and assess its relevance?

Review the application's source code to find the root cause of the vulnerability.

Create a new CVE identifier for the vulnerability immediately.

Search the CVE database for a matching identifier and review the associated references and descriptions.

Submit the vulnerability to the vendor's bug bounty program for a reward.

Certified Secure Software Lifecycle Professional

Domain 7Objective 10

Perform Vulnerability Management (e.g., Tracking, Triaging, Common Vulnerabilities and Exposures (CVE)) CSSLP Practice Questions (Page 5)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

11%of the exam

Questions 21–25

21foundation · easy
Which of the following is a related source that can supplement CVE data for assessing vulnerability relevance?
Select an answer first
22foundation · easy
What should a vulnerability report to stakeholders include?
Select an answer first
23foundation · easy
What does vulnerability lifecycle management encompass?
Select an answer first
24application · medium
A security team is reviewing a CVE for a vulnerability in a widely used open-source library. The CVE description mentions that the vulnerability is only exploitable if the library is used in a specific configuration. The team's applications use the library in a different configuration. What should the team do?
Select an answer first
25application · medium
A security analyst discovers a new vulnerability in a custom-built internal application. The analyst wants to determine if this vulnerability is already known and publicly documented. Which action should the analyst take to identify the vulnerability and assess its relevance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.