2.3 Define and Manage Comprehensive Vulnerability Management Programs (e.g., Vulnerabilities, Scanning, Penetration Testing, Threat Analysis) ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is reviewing a list of vulnerabilities found during a recent scan. The team must decide which vulnerabilities to remediate first. The organization has a high tolerance for downtime on internal systems but requires high availability for customer-facing services. Which factor should be the primary driver in prioritizing remediation?

   • AThe number of vulnerabilities found on each system
   • BThe availability of a vendor-supplied patch
   • CThe potential impact on customer-facing services
   • DThe ease of applying the patch
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is planning a penetration test of a critical application. The team has limited time and budget. Which approach should the team take to maximize the value of the penetration test?

   • AFocus the penetration test on the most critical functions and data flows.
   • BSkip the penetration test and rely on vulnerability scans.
   • CTest all application features, including low-risk ones, to ensure comprehensive coverage.
   • DUse automated scanning tools only, as they are faster and cheaper.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is managing a vulnerability that affects a critical application. The vendor has released a patch, but the patch is known to cause performance issues in some configurations. The application is heavily used during business hours. The team must decide how to proceed. Which approach best balances risk and operational impact?

   • ATest the patch in a staging environment and apply it during the next maintenance window.
   • BApply the patch only to non-critical instances and leave critical instances unpatched.
   • CDo not apply the patch and instead implement compensating controls.
   • DApply the patch immediately to all instances to eliminate the vulnerability.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a key component of ongoing vulnerability monitoring?

   • ADisabling vulnerability scanning after initial remediation is complete
   • BPerforming a single comprehensive scan annually
   • CFocusing only on vulnerabilities that have been exploited
   • DTracking the status of vulnerabilities and remediation actions over time
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team has identified a critical vulnerability in a legacy system that is no longer supported by the vendor. The system is essential to operations and cannot be replaced in the near term. The team must decide on a remediation strategy. Which approach is most appropriate?

   • AIsolate the system from the network and implement strict access controls.
   • BDecommission the system immediately to eliminate the vulnerability.
   • CIgnore the vulnerability because the system is essential and cannot be changed.
   • DImplement compensating controls and monitor the system closely.
   Reveal Solution Discussion Select an answer first