An experienced information security manager joins a new organization and begins by conducting an audit of all key IT processes. Which of the following findings about the vulnerability management…

Question

Options

• AVulnerabilities are identified by internal staff rather than by external consultants.
• BIdentified vulnerabilities are not logged and resolved in a timely manner.
• CThe number of vulnerabilities identified exceeds industry benchmarks.
• DIdentified vulnerabilities are not published and communicated in awareness programs.

• A
  11% (6)
• B
  70% (40)
• C
  4% (2)
• D
  16% (9)

Explanation

Why B is correct: Logging and timely remediation are the core operational outputs of any vulnerability management program - if identified vulnerabilities sit unresolved, the organization remains exposed regardless of how well vulnerabilities are found. A backlog of unresolved, untracked vulnerabilities represents a direct, ongoing risk to the organization.

Why the distractors are wrong:

• A is incorrect because using internal staff is a valid and common approach; the source of vulnerability identification (internal vs. external) is a preference or resource decision, not a control failure.
• C is incorrect because a high number of identified vulnerabilities may simply reflect a thorough or maturing program - finding more vulnerabilities can be a sign the process is working, not failing.
• D is incorrect because publishing vulnerabilities in awareness programs is a nice-to-have communication practice, but it is not a prerequisite for actually fixing the vulnerabilities; it has no bearing on the organization's exposure.

Memory tip: Think of vulnerability management as a pipeline - the output that matters is remediation. If vulnerabilities are found but never fixed or tracked, the entire pipeline is broken at the most critical stage. When the exam asks what's of "greatest concern," look for the choice that leaves the organization still exposed.

No community discussion yet for this question.