nerdexam
Isaca

CRISC · Question #65

Which of the following would be a risk practitioner's GREATEST concern with the use of a vulnerability scanning tool?

The correct answer is B. Inaccurate reporting of results. The greatest concern for a risk practitioner using a vulnerability scanning tool is inaccurate reporting of results, as this undermines the entire risk assessment process.

Submitted by mateo_ar· Apr 18, 2026IT Risk Assessment

Question

Which of the following would be a risk practitioner's GREATEST concern with the use of a vulnerability scanning tool?

Options

  • AIncreased time to remediate vulnerabilities
  • BInaccurate reporting of results
  • CIncreased number of vulnerabilities
  • DNetwork performance degradation

How the community answered

(28 responses)
  • A
    7% (2)
  • B
    79% (22)
  • C
    4% (1)
  • D
    11% (3)

Why each option

The greatest concern for a risk practitioner using a vulnerability scanning tool is inaccurate reporting of results, as this undermines the entire risk assessment process.

AIncreased time to remediate vulnerabilities

Increased time to remediate vulnerabilities is an operational challenge, but it doesn't fundamentally invalidate the output or purpose of the scanning tool itself.

BInaccurate reporting of resultsCorrect

Inaccurate reporting, whether false positives or false negatives, directly compromises the reliability of the vulnerability assessment and the subsequent risk management decisions. If the tool provides incorrect information, the practitioner cannot effectively prioritize or remediate actual risks, leading to misallocation of resources or unaddressed critical vulnerabilities, which can have severe security implications.

CIncreased number of vulnerabilities

An increased number of vulnerabilities is a finding, not a concern about the tool's functionality; it indicates a real issue to be addressed, which is the tool's purpose.

DNetwork performance degradation

Network performance degradation during a scan is a potential operational side effect, but it's generally temporary and doesn't affect the accuracy or utility of the scan results once obtained.

Concept tested: Vulnerability scanning tool accuracy

Topics

#Vulnerability scanning#Risk assessment tools#Reporting accuracy#False positives/negatives

Community Discussion

No community discussion yet for this question.

Full CRISC Practice