2.3 Define and Manage Comprehensive Vulnerability Management Programs (e.g., Vulnerabilities, Scanning, Penetration Testing, Threat Analysis) ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is building a vulnerability management program. The team has a limited budget and needs to justify the purchase of a new vulnerability scanner. Which approach would best support the business case?

   • AShow that the scanner is the most popular tool on the market.
   • BDemonstrate how the scanner will help identify and prioritize vulnerabilities on critical assets.
   • CExplain that the scanner will automate all security testing activities.
   • DState that the scanner will eliminate all vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of a vulnerability mitigation control, as opposed to a remediation control?

   • AImplementing a firewall rule to block access to a vulnerable service
   • BApplying a software patch to fix a known vulnerability
   • CUpgrading the operating system to a newer version
   • DDeleting the vulnerable software from the system
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has implemented a vulnerability management program and is now tracking remediation progress. The team needs to identify which vulnerabilities are not being remediated in a timely manner. Which metric would best help the team identify this?

   • AThe percentage of vulnerabilities that exceeded their remediation SLA
   • BThe average CVSS score of all open vulnerabilities
   • CThe total number of vulnerabilities discovered each month
   • DThe number of vulnerabilities that were closed in the last month
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A vulnerability scan has identified a high-severity vulnerability in a business-critical application. The patch requires a system reboot, which will cause downtime. The organization has a maintenance window in two weeks. What should the security team do?

   • AApply the patch immediately, even if it causes unscheduled downtime.
   • BImplement temporary compensating controls until the maintenance window.
   • CIgnore the vulnerability because the patch will be applied soon.
   • DWait for the maintenance window and apply the patch then.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is managing a vulnerability that has a high severity but a low likelihood of exploitation. The team has limited resources and must decide whether to remediate this vulnerability or a lower-severity vulnerability with a higher likelihood of exploitation. Which vulnerability should be prioritized?

   • ANeither vulnerability, because the team has limited resources.
   • BBoth vulnerabilities equally, because both are important.
   • CThe high-severity vulnerability, because severity is the most important factor.
   • DThe lower-severity vulnerability, because it is more likely to be exploited.
   Reveal Solution Discussion Select an answer first