Vulnerability Remediation -- Quiz

Question 1 of 6

A software vendor releases an emergency patch for a zero-day vulnerability that is actively being exploited in the wild. How does this differ from a scheduled patch, and what does it require from the organization?

A scheduled patch requires testing; an emergency patch should be deployed immediately to all systems without any testing An emergency patch is released outside the normal cycle due to active exploitation; organizations must compress or accelerate their testing timeline rather than waiting for the standard patch window An emergency patch covers more vulnerabilities than a scheduled patch and should be treated as higher priority than the CVSS score indicates Emergency patches are only relevant to internet-facing systems; internal systems can wait for the next scheduled cycle regardless of severity

Question 2 of 6

An organization's cybersecurity insurance policy is invoked after a ransomware attack. The insurer denies a portion of the claim because the IT manager intentionally disabled the backup system two weeks before the attack to free up storage space. Which insurance principle does this denial reflect?

Cybersecurity insurance never covers ransomware attacks regardless of circumstances The claim exceeds the policy coverage limit for data recovery expenses Cybersecurity insurance typically excludes losses caused by intentional acts by insured parties The insurer requires a 30-day waiting period before ransomware claims can be submitted

Question 3 of 6

A network administrator configures two VLANs on a single switch: VLAN 10 for the finance department and VLAN 20 for the HR department. A finance workstation needs to retrieve a report from an HR file server. What is required for this communication to succeed?

The file server must be assigned to both VLAN 10 and VLAN 20 simultaneously A Layer 3 device (router or Layer 3 switch) must route traffic between VLAN 10 and VLAN 20 Both devices must be assigned to the same VLAN, removing the segmentation between finance and HR The switch must be upgraded to a managed model that supports cross-VLAN communication natively

Question 4 of 6

A security team discovers a High-severity vulnerability in a critical manufacturing control system. The vendor has not released a patch, and applying any software change requires a full production shutdown. The system cannot be taken offline for weeks. Which approach best describes the appropriate immediate response?

Accept the vulnerability as an exception and take no further action until the vendor releases a patch Implement compensating controls — isolate the system through segmentation, restrict network access via firewall rules, and monitor for exploitation indicators — while preparing for a patched maintenance window Immediately shut down the manufacturing system to eliminate the attack surface regardless of production impact Purchase cybersecurity insurance to cover potential losses from exploitation of the vulnerability

Question 5 of 6

After deploying a patch to 500 servers, the patch management platform reports a 99% success rate (495 of 500). The security team plans to mark the remediation complete. What validation step should be performed before closing the ticket, and why?

Review the patch management logs for the 5 failures only; the 495 successes are confirmed by the platform report Ask system owners to self-certify that patches are working on their systems Rescan all 500 servers with a vulnerability scanner; deployment platform reports can silently fail, and rescanning confirms the vulnerability is actually absent The 99% success rate meets industry standards; no additional validation is required for patching at this scale

Question 6 of 6

A security committee reviews a vulnerability that can only be exploited by someone with physical access to the server console in a locked, badge-access data center. The patch conflicts with a critical application that cannot be updated for 12 months. The committee documents the risk and formally approves deferring remediation. This is an example of:

A false positive, because a vulnerability requiring physical access is not a real vulnerability A formal exception or exemption — a documented, committee-approved risk acceptance decision for a vulnerability that cannot currently be remediated A compensating control, because the physical access requirement reduces the risk An invalid security decision; all vulnerabilities must be patched regardless of exploitability or operational constraints

Matching

Match each description to the correct remediation strategy.

1. Installing a vendor-released software update to remove the vulnerability from the system

2. Dividing the network into isolated zones so that exploitation of one system cannot freely reach the rest

3. Disabling a vulnerable service or restricting access to it as a temporary measure until the patch can be deployed

4. A formally approved committee decision to leave a vulnerability unremediated because patching is not currently feasible

1. 2. 3. 4.

A. Patching

B. Segmentation

C. Compensating controls

D. Exception / Exemption

Vulnerability Remediation — Quiz

Matching