CRISC · Question #123
Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?
The correct answer is A. Software version. The software version is the most critical component in a software inventory for identifying and mitigating known vulnerabilities, as specific vulnerabilities are typically tied to particular software versions.
Question
Which component of a software inventory BEST enables the identification and mitigation of known vulnerabilities?
Options
- ASoftware version
- BAssigned software manager
- CSoftware support contract expiration
- DSoftware licensing information
How the community answered
(46 responses)- A93% (43)
- C4% (2)
- D2% (1)
Why each option
The software version is the most critical component in a software inventory for identifying and mitigating known vulnerabilities, as specific vulnerabilities are typically tied to particular software versions.
Known vulnerabilities are almost universally associated with specific software versions or version ranges, making the software version number essential for cross-referencing against vulnerability databases like CVEs to identify and apply relevant patches or mitigations.
The assigned software manager is responsible for the software but does not directly provide technical information needed to identify vulnerabilities.
Software support contract expiration is important for operational planning and budgeting but does not indicate the presence of technical vulnerabilities.
Software licensing information tracks legal usage rights but does not contain data relevant to identifying security flaws in the software itself.
Concept tested: Software vulnerability identification
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.