CRISC Practice Question: Arrange the steps for performing a vulnerability…

Arrange the steps for performing a vulnerability assessment.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Scope definition, then scanning, then analysis, then prioritization, then reporting

Vulnerability assessment starts with scope, scanning, analysis, prioritization, and reporting.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Scope definition, then scanning, then analysis, then prioritization, then reporting
Why this is correct
This is the correct order because vulnerability assessment must first define the scope, then perform scanning to identify vulnerabilities, analyze the results to understand impact, prioritize based on risk, and finally report findings.
✗
Scope definition, then scanning, then prioritization, then analysis, then reporting
Why it's wrong here
This is incorrect because prioritization should come after analysis; you cannot prioritize vulnerabilities without first analyzing their impact and likelihood.
✗
Scanning, then scope definition, then analysis, then prioritization, then reporting
Why it's wrong here
This is incorrect because scanning without a defined scope is inefficient and may miss critical assets; scope definition must come first.
✗
Scope definition, then analysis, then scanning, then prioritization, then reporting
Why it's wrong here
This is incorrect because analysis cannot occur before scanning; scanning provides the raw data needed for analysis.

Go deeper