CRISC · Question #65
Which of the following would be a risk practitioner's GREATEST concern with the use of a vulnerability scanning tool?
The correct answer is B. Inaccurate reporting of results. The greatest concern for a risk practitioner using a vulnerability scanning tool is inaccurate reporting of results, as this undermines the entire risk assessment process.
Question
Which of the following would be a risk practitioner's GREATEST concern with the use of a vulnerability scanning tool?
Options
- AIncreased time to remediate vulnerabilities
- BInaccurate reporting of results
- CIncreased number of vulnerabilities
- DNetwork performance degradation
How the community answered
(28 responses)- A7% (2)
- B79% (22)
- C4% (1)
- D11% (3)
Why each option
The greatest concern for a risk practitioner using a vulnerability scanning tool is inaccurate reporting of results, as this undermines the entire risk assessment process.
Increased time to remediate vulnerabilities is an operational challenge, but it doesn't fundamentally invalidate the output or purpose of the scanning tool itself.
Inaccurate reporting, whether false positives or false negatives, directly compromises the reliability of the vulnerability assessment and the subsequent risk management decisions. If the tool provides incorrect information, the practitioner cannot effectively prioritize or remediate actual risks, leading to misallocation of resources or unaddressed critical vulnerabilities, which can have severe security implications.
An increased number of vulnerabilities is a finding, not a concern about the tool's functionality; it indicates a real issue to be addressed, which is the tool's purpose.
Network performance degradation during a scan is a potential operational side effect, but it's generally temporary and doesn't affect the accuracy or utility of the scan results once obtained.
Concept tested: Vulnerability scanning tool accuracy
Topics
Community Discussion
No community discussion yet for this question.