Information Security Risk Management →hardMultiple ChoiceObjective-mapped

CISM Information Security Risk Management Practice Question

Exhibit

Refer to the exhibit.

Vulnerability Scan Summary Report
11-Jun-2023 04:15:42

Host: 192.168.10.25
Total vulnerabilities: 12
Critical: 2
High: 4
Medium: 3
Low: 3

Host: 192.168.10.30
Total vulnerabilities: 8
Critical: 0
High: 1
Medium: 5
Low: 2

Host: 192.168.10.35
Total vulnerabilities: 20
Critical: 5
High: 6
Medium: 7
Low: 2

Which host should be prioritized for risk mitigation based on the vulnerability scan results?

⚠ Common exam trap

Watch out — candidates often assume all vulnerabilities should be treated equally or that the host with the most vulnerabilities is always the highest priority, ignoring the criticality of the asset and the exploitability of the vulnerabilities.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

192.168.10.35

Host 192.168.10.35 is prioritized because it has the highest number of critical vulnerabilities (e.g., CVE-2023-XXXX with CVSS 9.8) and is exposed to the internet, increasing the likelihood of exploitation. Risk mitigation prioritization is based on the combination of vulnerability severity, asset criticality, and threat exposure, not just vulnerability count.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
192.168.10.25
Why it's wrong here
Fewer critical/high than .35.
✓
192.168.10.35
Why this is correct
Highest count of critical and high vulnerabilities.
✗
All hosts should be equally prioritized
Why it's wrong here
Risk levels differ significantly.
✗
192.168.10.30
Why it's wrong here
Only 1 high vulnerability.

Go deeper

CISM Information Security Risk Management Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question