CISM Question 120

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  if the question used the word “maturity” instead of “effectiveness,” then C would indeed be the best answer.

• 1

  D cannot be right, since risk is a function of a threat and a vulnerability. The question is talking about a vulnerability management program. Vulnerabilities can be effectively managed by quickly identifying vulnerabilities, having reliable sources of patches, having a thorough test and patch process. All these measures can be summarized as proactively managing controls - therefore option C is right.

• Chose D4

  D. Risks are managed within acceptable limits. An effective vulnerability management program is primarily aimed at identifying, classifying, remediating, and mitigating vulnerabilities to maintain risk at acceptable levels. While reporting security incidents in a timely manner (A), accurately identifying threats (B), and managing controls proactively (C) are important components of a comprehensive security program, the best indicator of an effective vulnerability management program specifically is that risks are consistently managed within acceptable limits (D). This implies that vulnerabilities are being handled in a way that minimizes the potential for exploitation and keeps the security posture of the organization within its risk tolerance threshold.