Which of the following should be done FIRST upon learning that a production web server used by clients has a critical vulnerability?

The correct answer is B. Validate the finding. Before taking any remediation, escalation, or compensating action, the finding must be validated to confirm it is real, applicable to the specific environment, and not a false positive. Acting on an unvalidated finding can waste resources, cause unnecessary outages, or create…

Submitted by suresh_in· Apr 18, 2026Information Security Incident Management

Question

Options

AContact the business system owner.
BValidate the finding.
CImplement compensating controls.
DPerform a gap analysis.

How the community answered

(33 responses)

A
9% (3)
B
82% (27)
C
6% (2)
D
3% (1)

Explanation

Before taking any remediation, escalation, or compensating action, the finding must be validated to confirm it is real, applicable to the specific environment, and not a false positive. Acting on an unvalidated finding can waste resources, cause unnecessary outages, or create alarm without cause. Contacting the business system owner (A) is appropriate after validation. Implementing compensating controls (C) and performing a gap analysis (D) are premature without first confirming the vulnerability exists. Validation is always the first step in vulnerability management to ensure response efforts are justified and proportionate.

Topics

#Vulnerability management#Incident response process#Vulnerability validation#Security operations

Community Discussion

No community discussion yet for this question.

Full CISM Practice