Question 440
A CVSS-high weakness affects an isolated test device while a medium flaw exposes payroll data externally. Which response best addresses the central security requirement with a defensible, risk-based design?
- Ignore externally exposed flaws without vendor exploits
- Always fix the numerically highest CVSS first regardless of context
- Stop unauthorized testing and follow responsible disclosure and agreed escalation channels
- Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone
Explanation
Correct Answer
D:Technical severity is an input, not the full enterprise risk ranking.
Incorrect Answers
A:Practical abuse can precede public exploitation.
B:Scores do not encode all local impact factors.
C:The discovery does not expand testing authorization automatically. Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone.
Question 441
A critical plant cannot patch immediately without stopping life-safety equipment. Which response best addresses the central security requirement with a defensible, risk-based design?
- Make the exception permanent with no expiration
- Require a time-bound owner-approved exception with compensating controls and reassessment
- Ignore the vulnerability because production matters
- Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone
Explanation
Correct Answer
B:Exceptions preserve accountability when immediate remediation is unsafe.
Incorrect Answers
A:Indefinite waiver hides residual risk.
C:Unmanaged exposure persists.
D:Technical severity is an input, not the full enterprise risk ranking. Require a time-bound owner-approved exception with compensating controls and reassessment.
Question 442
A vendor marks a security defect closed after deploying a new configuration. Which response best addresses the central security requirement with a defensible, risk-based design?
- Change the ticket priority to low
- Require a time-bound owner-approved exception with compensating controls and reassessment
- Close the finding when the vendor sends an email
- Retest the original exploit condition and related bypass paths before closure
Explanation
Correct Answer
D:Completion reports are not evidence of effective correction.
Incorrect Answers
A:Relabeling does not eliminate weakness.
B:Exceptions preserve accountability when immediate remediation is unsafe. Retest the original exploit condition and related bypass paths before closure.
C:Status is not proof of technical outcome.
Question 443
A tester finds a severe flaw on a partner's system outside the written engagement scope. Which response best addresses the central security requirement with a defensible, risk-based design?
- Stop unauthorized testing and follow responsible disclosure and agreed escalation channels
- Exploit the partner to collect more proof without permission
- Publish working exploit details without notification
- Retest the original exploit condition and related bypass paths before closure
Explanation
Correct Answer
A:The discovery does not expand testing authorization automatically.
Incorrect Answers
B:Out-of-scope exploitation creates harm and liability.
C:Uncoordinated release may increase victimization.
D:Completion reports are not evidence of effective correction. Stop unauthorized testing and follow responsible disclosure and agreed escalation channels.
Question 444
A scanning service rates a vulnerability as medium but it exposes an authentication secret on a publicly reachable endpoint. Which response best addresses the central security requirement with a defensible, risk-based design?
- Adjust triage using actual exposure, exploitability, business impact and sensitive asset role
- Require a time-bound owner-approved exception with compensating controls and reassessment
- Suppress the finding because its CVSS is not critical
- Rank only by scanner color code
Explanation
Correct Answer
A:Vendor severity alone may understate a specific organization's risk.
Incorrect Answers
B:Exceptions preserve accountability when immediate remediation is unsafe. Adjust triage using actual exposure, exploitability, business impact and sensitive asset role.
C:A moderate score can still threaten high-value assets.
D:Generic ratings omit local context.
Question 445
After a prior exception finding, a university consortium reports that the approved safeguard is implemented: “Require a time-bound owner-approved exception with compensating controls and reassessment.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Require a time-bound owner-approved exception with compensating controls and reassessment
- Use the completion of this alternative as proof: Ignore the vulnerability because production matters
- Run this adjacent but different test as the sole proof: Run controlled regression tests that previously failed
- Check safeguards, expiry and the next remediation window
Explanation
Correct Answer
D:Expiration and review prevent exception drift.
Incorrect Answers
A:Check safeguards, expiry and the next remediation window. Expiration and review prevent exception drift.
B:Unmanaged exposure persists. Check safeguards, expiry and the next remediation window.
C:Reproducible negative result validates remediation. It tests remediation validation, while this case requires evidence about exception.
Question 446
A cloud firewall rule was changed to close an exposure, but the application still allows the same traffic through another path. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trust the completed change ticket as technical closure
- Stop unauthorized testing and follow responsible disclosure and agreed escalation channels
- Retest exploit or connectivity paths from relevant threat locations after the fix
- Delete the finding rather than retesting
Explanation
Correct Answer
C:A configuration change is not proof a vulnerability has been removed.
Incorrect Answers
A:Tickets record intent, not effective traffic.
B:The discovery does not expand testing authorization automatically. Retest exploit or connectivity paths from relevant threat locations after the fix.
D:Removing evidence leaves the weakness.
Question 447
After a prior ethical disclosure finding, a regulated financial institution reports that the approved safeguard is implemented: “Stop unauthorized testing and follow responsible disclosure and agreed escalation channels.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Stop unauthorized testing and follow responsible disclosure and agreed escalation channels
- Verify disclosure reached authorized contacts with minimal necessary evidence
- Run this adjacent but different test as the sole proof: Check safeguards, expiry and the next remediation window
- Use the completion of this alternative as proof: Exploit the partner to collect more proof without permission
Explanation
Correct Answer
B:Controlled handling supports ethics and safety.
Incorrect Answers
A:Verify disclosure reached authorized contacts with minimal necessary evidence. Controlled handling supports ethics and safety.
C:Expiration and review prevent exception drift. It tests exception, while this case requires evidence about ethical disclosure.
D:Out-of-scope exploitation creates harm and liability. Verify disclosure reached authorized contacts with minimal necessary evidence.
Question 448
After a prior finding severity finding, a global logistics firm reports that the approved safeguard is implemented: “Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Always fix the numerically highest CVSS first regardless of context
- Run this adjacent but different test as the sole proof: Check safeguards, expiry and the next remediation window
- Document risk ranking assumptions and owner-approved treatment deadlines
- Accept a signed change ticket saying: Prioritize findings by exploitability, exposure, asset criticality and business impact rather than score alone
Explanation
Correct Answer
C:Contextual severity supports defensible triage.
Incorrect Answers
A:Scores do not encode all local impact factors. Document risk ranking assumptions and owner-approved treatment deadlines.
B:Expiration and review prevent exception drift. It tests exception, while this case requires evidence about finding severity.
D:Document risk ranking assumptions and owner-approved treatment deadlines. Contextual severity supports defensible triage.
Question 449
An incident review documented this exception exposure: A critical plant cannot patch immediately without stopping life-safety equipment. The response team proposed only “Ignore the vulnerability because production matters” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Status is not proof of technical outcome.
- Unmanaged exposure persists.
- Indefinite waiver hides residual risk.
- Uncoordinated release may increase victimization.
Explanation
Correct Answer
B:Unmanaged exposure persists. The relevant alternative is unmanaged exposure persists.
Incorrect Answers
A:Status is not proof of technical outcome. That does not establish unmanaged exposure persists.
C:Indefinite waiver hides residual risk. The actual criticized measure is unmanaged exposure persists.
D:Uncoordinated release may increase victimization. The actual criticized measure is unmanaged exposure persists.
Question 450
After a prior remediation validation finding, a payment-services company reports that the approved safeguard is implemented: “Retest the original exploit condition and related bypass paths before closure.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Verify disclosure reached authorized contacts with minimal necessary evidence
- Use the completion of this alternative as proof: Close the finding when the vendor sends an email
- Run controlled regression tests that previously failed
- Accept a signed change ticket saying: Retest the original exploit condition and related bypass paths before closure
Explanation
Correct Answer
C:Reproducible negative result validates remediation.
Incorrect Answers
A:Controlled handling supports ethics and safety. It tests ethical disclosure, while this case requires evidence about remediation validation.
B:Status is not proof of technical outcome. Run controlled regression tests that previously failed.
D:Run controlled regression tests that previously failed. Reproducible negative result validates remediation.
Certified Information Systems Security Professional (CISSP) Practice Tests