CISM Information Security Programme Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To enforce access control policies

  Why it's wrong here

  Enforcing access control policies is the function of identity and access management, which governs who may reach a resource; it does not discover, prioritise or remediate software flaws. Vulnerability management identifies, ranks and tracks weaknesses across assets. Access control would be the right focus when the requirement is authorisation or least-privilege enforcement.

• ✗

  To detect and respond to security incidents

  Why it's wrong here

  Incident detection and response belongs to incident management and SOC operations; vulnerability management finds and remediates weaknesses before exploitation. The confusion is tempting because both are security operations functions, but response occurs after an event, whereas vulnerability management reduces the attack surface beforehand.

• ✗

  To manage third-party security risks

  Why it's wrong here

  Third-party risk is handled by supplier and vendor risk management; vulnerability management identifies, prioritises and remediates weaknesses in owned assets. The overlap is tempting because third-party software introduces vulnerabilities, but the program's scope is technical weakness remediation, not supplier relationship risk.

• ✓

  To identify, assess, and remediate security weaknesses in systems

  Why this is correct

  A vulnerability management programme systematically discovers, prioritises and fixes weaknesses across the estate, directly satisfying the stem's demand for its primary purpose. Identification feeds risk-based assessment, which drives remediation decisions. This continuous cycle reduces exploitable exposure, distinguishing it from penetration testing, which offers only a point-in-time snapshot rather than ongoing assurance.

Go deeper

Related to this question