2.3 Define and Manage Comprehensive Vulnerability Management Programs (e.g., Vulnerabilities, Scanning, Penetration Testing, Threat Analysis) ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is the primary purpose of classifying assets in a vulnerability management program?

   • ATo satisfy regulatory requirements for data retention
   • BTo determine the appropriate frequency of vulnerability scans for each asset
   • CTo replace the need for a formal risk assessment process
   • DTo assign ownership of assets to specific departments
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a vulnerability management program, what is the primary purpose of asset prioritization?

   • ATo ensure that all assets receive the same level of security controls
   • BTo reduce the total number of assets that need to be scanned
   • CTo comply with licensing agreements for security tools
   • DTo focus remediation efforts on the assets that pose the greatest risk to the organization
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial services firm is deploying a new customer-facing web application. The security team must integrate vulnerability management into the deployment pipeline. The application will be hosted on a mix of cloud and on-premises infrastructure. The team has limited resources and needs to focus scanning efforts on the most critical components. Which approach should the security team take first?

   • ADeploy a penetration test on the new application before any vulnerability scanning.
   • BIdentify and classify all assets, then prioritize them based on criticality and impact to guide scanning.
   • CImplement a patch management solution and apply all available patches immediately.
   • DPerform a full vulnerability scan of all assets immediately to establish a baseline.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is implementing a vulnerability management program for a large organization with many assets. The team has limited resources and must decide how to prioritize scanning and remediation. Which approach is most effective?

   • AScan all assets equally and remediate vulnerabilities in the order they are discovered.
   • BUse a single scanning frequency for all assets to simplify the process.
   • CClassify assets by criticality and scan the most critical assets more frequently.
   • DScan only the assets that are known to have had vulnerabilities in the past.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is planning a comprehensive security testing program. The team must decide between conducting more frequent vulnerability scans or more frequent penetration tests. The organization has a limited budget. Which approach is most effective?

   • AConduct only vulnerability scans to save budget.
   • BConduct frequent penetration tests and less frequent vulnerability scans.
   • CConduct frequent vulnerability scans and less frequent penetration tests.
   • DConduct only penetration tests to get a realistic assessment.
   Reveal Solution Discussion Select an answer first