A security engineer is responsible for monitoring company applications for known vulnerabilities. Which of the following is a way to stay current on exploits and information security news?

Updating internal policies and procedures does not provide any external threat intelligence about new exploits or emerging attack techniques.

Security mailing lists such as those from CISA, SANS Internet Storm Center, vendor security advisories, and CVE announcement lists deliver real-time notifications of newly discovered vulnerabilities and active exploits directly to the engineer. This keeps the engineer informed of threats as they emerge, enabling rapid response before patches or compensating controls are deployed. No other option listed provides this kind of continuous, up-to-date external threat feed.

Security awareness training educates end users about general threats but does not provide the engineer with timely, technical exploit information.

Keeping the vulnerability management plan current is a process improvement activity that does not directly supply current exploit or threat news.