100-160 Question 192
Select 3A cybersecurity team has discovered a potential vulnerability in their organization’s web application. The team decides to consult a vulnerability database to assess the issue. Which of the following actions are most appropriate to effectively address the situation?
- A
Search for the vulnerability in a reliable vulnerability database and review its associated CVE details to determine severity and potential mitigations.
- B
Update documentation immediately with the discovered vulnerability and its remediation steps without verifying or testing.
- C
Use industry-standard tools to scan the system for other potential vulnerabilities that could compound the issue.
- D
Subscribe to a cybersecurity threat intelligence service to proactively monitor for similar vulnerabilities or exploits in the future.
- E
Wait for the next scheduled cybersecurity report to include the vulnerability analysis and remediation plan.
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively address a discovered vulnerability, it is essential to research the vulnerability in a reliable database, use tools to assess the broader security posture, and leverage threat intelligence to stay proactive. Delaying action or failing to verify information can increase risk and hinder mitigation efforts.
- A. Correct.
Consulting a vulnerability database and reviewing the CVE details is critical for understanding the severity, impact, and remediation steps. This ensures informed decision-making.
- B. Incorrect.
Updating documentation without verifying or testing the vulnerability and its remediation steps can lead to incomplete or misleading information, which can jeopardize security.
- C. Correct.
Using industry-standard tools to scan for related vulnerabilities ensures a thorough assessment of the system and helps identify additional weaknesses that may need attention.
- D. Correct.
Subscribing to a threat intelligence service provides proactive monitoring and helps stay ahead of emerging threats, which is essential for long-term cybersecurity strategy.
- E. Incorrect.
Waiting for the next scheduled report delays the response to the vulnerability, increasing the risk of exploitation. Immediate action is necessary.