PECB
ISO-IEC-27001-LEAD-AUDITOR · Question #299
Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?
The correct answer is C. All vulnerabilities require immediate implementation of controls regardless of corresponding. Not all vulnerabilities require immediate remediation. Risk assessment determines whether controls are necessary. Some vulnerabilities pose low risks and may not need urgent fixes.
Risk Assessment and Vulnerability Management
Question
Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?
Options
- AVulnerabilities can be intrinsic or extrinsic, related to the characteristics of the asset or to external
- BThreats must exploit a vulnerability to have a negative impact on the confidentiality, integrity,
- CAll vulnerabilities require immediate implementation of controls regardless of corresponding
How the community answered
(52 responses)- A4% (2)
- B2% (1)
- C94% (49)
Explanation
Not all vulnerabilities require immediate remediation. Risk assessment determines whether controls are necessary. Some vulnerabilities pose low risks and may not need urgent fixes.
Topics
#threats#vulnerabilities#risk assessment#control implementation
Community Discussion
No community discussion yet for this question.