Which of the following BEST demonstrates the effectiveness of the vulnerability management process?

The correct answer is B. Results from internal vulnerability scans. Internal vulnerability scan results directly measure how well the program is identifying and tracking vulnerabilities over time. Metrics such as mean time to remediate, number of open vs. closed vulnerabilities, and trends in severity levels reflect the actual operational…

Submitted by andres_qro· Apr 18, 2026Information Security Program Development and Management

Question

Options

AResults from a third-party audit
BResults from internal vulnerability scans
CBudget allocation for vulnerability management
DTime required to test patch before deployment

How the community answered

(34 responses)

A
3% (1)
B
74% (25)
C
15% (5)
D
9% (3)

Explanation

Internal vulnerability scan results directly measure how well the program is identifying and tracking vulnerabilities over time. Metrics such as mean time to remediate, number of open vs. closed vulnerabilities, and trends in severity levels reflect the actual operational effectiveness of the process. Third-party audits (A) provide an independent snapshot but are periodic and do not reflect day-to-day process performance. Budget allocation (C) shows investment, not outcomes. Time required to test patches (D) is one contributing metric but covers only a single step in the process and does not represent overall effectiveness.

Topics

#Vulnerability Management#Security Metrics#Effectiveness Measurement#Vulnerability Scanning

Community Discussion

No community discussion yet for this question.

Full CISM Practice