During a post-incident review, it was determined that a known vulnerability was exploited in order to gain access to a system. The vulnerability was patched as part of the remediation on the…

Question

Options

• AReview the vulnerability management process.
• BInstall patches on all existing systems.
• CScan to determine whether the vulnerability is present on other systems.
• DReport the root cause of the vulnerability to senior management

• A
  3% (1)
• B
  11% (4)
• C
  81% (30)
• D
  5% (2)

Explanation

Scanning first (C) is the correct immediate next step because you must identify the full scope of exposure before taking further action - patching one system while the same vulnerability exists undetected on others leaves the organization still at risk. Option B (patching all systems) is tempting but premature: you can't efficiently patch what you haven't confirmed is vulnerable, and blanket patching without scoping wastes resources and risks unplanned downtime. Option A (reviewing the vulnerability management process) and Option D (reporting to senior management) are both valid actions, but they belong to the lessons-learned and reporting phases of incident response, not the immediate remediation phase.

Memory tip: Remember the sequence Scope → Patch → Review → Report. The word "NEXT" in these questions almost always signals an immediate operational action - scanning to scope the blast radius comes before any broader remediation or process improvement.

No community discussion yet for this question.