2.3 Define and Manage Comprehensive Vulnerability Management Programs (e.g., Vulnerabilities, Scanning, Penetration Testing, Threat Analysis) ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is reporting on the status of vulnerability remediation to senior management. The team has data on the number of vulnerabilities, their severity, and the time to remediate. Management wants to understand the overall risk to the organization. Which reporting approach is most effective?

   • AReport the number of vulnerabilities found in each department.
   • BReport the number of open critical vulnerabilities and the average time to remediate them.
   • CReport the total number of vulnerabilities and the percentage that have been remediated.
   • DReport a risk score that combines vulnerability severity, asset criticality, and remediation progress.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary goal of prioritizing threats and vulnerabilities based on risk?

   • ATo focus remediation on the vulnerabilities that pose the highest risk to the organization
   • BTo remediate all vulnerabilities as quickly as possible, regardless of severity
   • CTo ensure that all vulnerabilities are reported to regulators
   • DTo eliminate the need for penetration testing
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst has identified several vulnerabilities across the organization. The vulnerabilities include a critical remote code execution flaw on a public-facing web server, a high-severity SQL injection in an internal application, and a medium-severity misconfiguration on a development server. The organization has limited patching resources. Which vulnerability should be remediated first?

   • AThe medium-severity misconfiguration on the development server
   • BAll three vulnerabilities simultaneously to reduce overall risk
   • CThe high-severity SQL injection in the internal application
   • DThe critical remote code execution on the public-facing web server
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security manager is planning the annual security testing schedule. The organization has a mix of critical and non-critical systems. The manager wants to ensure that security testing is comprehensive but also efficient. Which testing strategy best balances these needs?

   • ARun a single comprehensive penetration test on all systems annually and no vulnerability scans.
   • BRun vulnerability scans only on critical systems and perform penetration testing on non-critical systems annually.
   • CRun vulnerability scans on all systems monthly and perform penetration testing on critical systems annually.
   • DRun penetration testing on all systems monthly and skip vulnerability scanning.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is preparing to conduct a vulnerability scan of the organization's network. The team has a list of IP addresses but is unsure which systems are most critical. What should the team do before scanning?

   • AAsk the network administrator which systems are usually busy.
   • BIdentify and classify the systems on the network to determine their criticality.
   • CSkip scanning and proceed directly to penetration testing.
   • DScan all IP addresses without prioritization to ensure complete coverage.
   Reveal Solution Discussion Select an answer first