A security officer wants to implement a vulnerability scanning program. The officer is uncertain of the state of vulnerability resiliency within the organization's large IT infrastructure. What…

Question

Options

• AScan a representative sample of systems
• BPerform the scans only during off-business hours
• CDecrease the vulnerabilities within the scan tool settings
• DFilter the scan output so only pertinent data is analyzed

• A
  82% (42)
• B
  6% (3)
• C
  2% (1)
• D
  10% (5)

Explanation

Scanning a representative sample of systems gives you statistically valid insight into your vulnerability posture without the noise and volume of scanning every device - it's the standard technique when assessing a large, unknown environment efficiently. Option B (off-hours scanning) reduces operational disruption but does nothing to reduce data volume or improve representativeness. Option C is a trap - decreasing sensitivity in the scan tool means you'll miss real vulnerabilities, giving you an unrealistic (not just smaller) view. Option D (filtering output after the fact) still generates the full scan dataset; you're just ignoring some of it, which doesn't truly minimize output and risks discarding meaningful findings.

Memory tip: Think of it like a political poll - you don't survey every citizen to understand public opinion; you survey a representative sample. Same logic applies here: sample → smaller data, still accurate picture.

No community discussion yet for this question.