Which of the following is a key consideration when managing a penetration testing engagement?

Obtaining written authorization and defining the scope of the test

Ensuring that the testing is performed without any prior notification to stakeholders

Using only manual testing techniques to avoid detection by security tools

Ensuring that the test is performed during business hours to minimize disruption

What is the primary goal of vulnerability remediation?

To document the vulnerability for compliance purposes

To eliminate or fix the underlying vulnerability

To transfer the risk to a third party

To reduce the likelihood of exploitation by implementing compensating controls

A security team has implemented a vulnerability management program. The team needs to communicate the status of vulnerabilities to senior management on a regular basis. Which reporting approach is most effective for this audience?

Provide a report only when a critical vulnerability is found.

Provide a raw export of the vulnerability scanner's findings.

Provide a detailed technical report listing every vulnerability and its CVSS score.

Provide a high-level dashboard showing overall risk posture, remediation progress, and trends.

During the asset identification phase of a vulnerability management program, which action best aligns with classifying assets based on their criticality and impact?

Grouping assets by their operating system version to simplify patch management

Listing all software applications installed on each server for license compliance

Assigning a business impact rating to each asset based on the potential consequences of its compromise

Recording the IP address and hostname of every device connected to the network

What is the primary purpose of vulnerability reporting to stakeholders?

To replace the need for regular vulnerability scans

To communicate the organization's risk posture and the effectiveness of remediation efforts

To provide a detailed technical list of all vulnerabilities for the security team

To satisfy the requirements of external auditors only

Information Systems Security Management Professional

Domain 2Objective 3

2.3 Define and Manage Comprehensive Vulnerability Management Programs (e.g., Vulnerabilities, Scanning, Penetration Testing, Threat Analysis) ISSMP Practice Questions (Page 6)

Part of the Systems Lifecycle Management domain, which accounts for 15% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

15%of the exam

Questions 26–30

26foundation · easy
Which of the following is a key consideration when managing a penetration testing engagement?
Select an answer first
27foundation · easy
What is the primary goal of vulnerability remediation?
Select an answer first
28application · medium
A security team has implemented a vulnerability management program. The team needs to communicate the status of vulnerabilities to senior management on a regular basis. Which reporting approach is most effective for this audience?
Select an answer first
29foundation · easy
During the asset identification phase of a vulnerability management program, which action best aligns with classifying assets based on their criticality and impact?
Select an answer first
30foundation · easy
What is the primary purpose of vulnerability reporting to stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.