Which statement explains the correlation between the block and alert thresholds in a vulnerability management policy?

Question

Options

• AThe thresholds can be set to informational, low, medium, high, and critical.
• BThe alert threshold always has precedence over, and can be greater than, the block threshold.
• CThe block threshold must always be equal to or greater than the alert threshold.
• DThe block threshold always has precedence over, and can be less than, the alert threshold.

• A
  5% (1)
• B
  5% (1)
• C
  80% (16)
• D
  10% (2)

Explanation

Option C is correct because in vulnerability management policies, the block threshold represents a more severe action than alerting - blocking stops traffic/access entirely, while alerting merely notifies. It would be illogical to block on lower-severity vulnerabilities while only alerting on higher ones, so the block threshold must be set at an equal or higher severity level than the alert threshold to maintain a sensible escalation hierarchy.

Why the distractors fail:

• A describes severity levels (informational through critical), not the relationship between thresholds - it's true but answers a different question entirely.
• B inverts the logic: alert cannot override block, as block is the stronger enforcement action; giving alert "precedence" would undermine the policy's purpose.
• D is a trap - while block does take precedence over alert as an action, saying it "can be less than" the alert threshold means you'd be blocking lower-severity findings while only alerting on higher ones, which is backwards.

Memory tip: Think of it as an escalation ladder - you alert first, then block if things are worse. So block ≥ alert, just like a bouncer (block) has a higher bar to intervene than a security camera (alert).

No community discussion yet for this question.