Which of the following is the correct order of the steps to take when a system is suspected of being vulnerable?

Question

Options

• AScanning scope, identification, assessment, and remediation
• BAssessment, identification, scanning scope, and remediation
• CIdentification, scanning scope, assessment, and remediation
• DAssessment, scanning scope, identification, and remediation

• A
  92% (34)
• B
  3% (1)
• C
  5% (2)

Explanation

The correct vulnerability management workflow follows a logical sequence: (1) Scanning scope - define the boundaries of what will be scanned (which systems, IP ranges, or assets) to focus effort and avoid scanning unauthorized targets; (2) Identification - run the vulnerability scan to discover actual weaknesses present in the scoped systems; (3) Assessment - evaluate the identified vulnerabilities for severity, exploitability, and business impact (often using CVSS scores) to prioritize which to address first; (4) Remediation - apply patches, configuration changes, or mitigations to fix the highest-priority vulnerabilities. You cannot identify before knowing what to scan, cannot assess before identifying, and cannot remediate before assessing priority. The other answer choices place these steps out of logical order.

No community discussion yet for this question.