Which is the BEST first action when a vulnerability scanner reports a high-severity finding on a critical system?
A CISSP practice question covering Domain 6: Security Assessment and Testing. Try answering before reading the explanation below.
Show options & answer
Why "Verify the finding, assess exploitability and exposure, then prioritize remediation per change management" is the right answer
Verify (confirm not a false positive), assess context (exposure, asset value, exploitability), then remediate via change control. Blind patching can break dependencies; ignoring leaves risk; disabling may be disproportionate.
Take the full CISSP practice test
120 questions, instant explanations, study-video links on every miss. No account.