An organization has implemented controls to mitigate risks resulting from identified vulnerabilities in an application. Which of the following is the BEST way to verify all weaknesses have been…

The correct answer is C. Conduct penetration testing. Penetration testing simulates real-world attacks to identify any remaining exploitable vulnerabilities after controls are implemented. It validates that mitigation has been successful from an attacker's perspective. "Penetration testing is essential to verify the effectiveness…

Submitted by skyler.x· Apr 18, 2026Information Security Risk Management

Question

An organization has implemented controls to mitigate risks resulting from identified vulnerabilities in an application. Which of the following is the BEST way to verify all weaknesses have been addressed?

Options

APerform a vulnerability assessment
BConduct an internal audit
CConduct penetration testing
DPrepare compensating controls

How the community answered

(43 responses)

A
5% (2)
B
16% (7)
C
72% (31)
D
7% (3)

Explanation

Penetration testing simulates real-world attacks to identify any remaining exploitable vulnerabilities after controls are implemented. It validates that mitigation has been successful from an attacker's perspective. "Penetration testing is essential to verify the effectiveness of remediation efforts and ensure vulnerabilities can no longer be exploited." Vulnerability assessments and audits are valuable, but pen testing provides practical assurance.

Topics

#Penetration Testing#Vulnerability Management#Control Validation#Security Testing

Community Discussion

No community discussion yet for this question.

Full CISM Practice