2.3 Define and Manage Comprehensive Vulnerability Management Programs (e.g., Vulnerabilities, Scanning, Penetration Testing, Threat Analysis) ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary difference between vulnerability scanning and penetration testing?

   • AVulnerability scanning is performed by automated tools, while penetration testing is always manual
   • BVulnerability scanning is only for external systems, while penetration testing is only for internal systems
   • CVulnerability scanning requires written authorization, while penetration testing does not
   • DVulnerability scanning identifies potential weaknesses, while penetration testing actively exploits them to confirm impact
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A vulnerability scan has identified a critical vulnerability in a legacy application that cannot be patched because the vendor no longer provides updates. The application is essential to business operations. Which remediation approach should the security team take?

   • AUpgrade the application to the latest version even though the vendor no longer supports it.
   • BRemove the application from the network immediately to eliminate the vulnerability.
   • CImplement compensating controls such as network segmentation and strict access controls.
   • DIgnore the vulnerability because the vendor no longer supports the application.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which factor is most directly used to prioritize assets for vulnerability management?

   • AThe asset's physical location
   • BThe number of vulnerabilities reported on the asset
   • CThe asset's criticality to business operations
   • DThe age of the asset
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security manager is planning a penetration test for a critical application. The test must not disrupt production services, but the organization wants a realistic assessment of its security posture. Which testing approach best meets these requirements?

   • APerform a grey-box test against production during off-peak hours.
   • BSkip the penetration test and rely on vulnerability scans.
   • CPerform a white-box test in a staging environment that mirrors production.
   • DPerform a black-box test against the production environment during peak hours.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following best describes the purpose of a risk-based approach to vulnerability prioritization?

   • ATo assign a severity score to every vulnerability based on its CVSS rating
   • BTo determine which vulnerabilities are most likely to be exploited and cause the most damage
   • CTo identify the root cause of vulnerabilities in the software development lifecycle
   • DTo ensure that all vulnerabilities are patched within a fixed time frame
   Reveal Solution Discussion Select an answer first