CISSP Practice Question: A company's vulnerability management program…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deploy a host-based intrusion detection system (HIDS)

  Why it's wrong here

  Deploying a Host-based Intrusion Detection System (HIDS) primarily serves as a detective control. While a HIDS can identify suspicious activities or attack patterns *after* they occur on the system, it does not inherently prevent the initial exploitation of a known vulnerability. Its role is to alert security personnel to potential compromises, enabling a response, rather than proactively blocking the successful execution of an exploit against the underlying flaw.

• ✗

  Increase logging and monitoring

  Why it's wrong here

  Increasing logging and monitoring capabilities are crucial detective controls that enhance visibility into system activities and potential security incidents. However, these measures do not prevent an attacker from successfully exploiting a vulnerability. They provide the means to detect an ongoing attack or analyze a post-compromise scenario, offering valuable forensic data, but they do not actively block the initial attack vector or mitigate the vulnerability itself.

• ✓

  Segment the system from the rest of the network

  Why this is correct

  Segmenting the system from the rest of the network is a highly effective preventive and mitigating control for managing a known vulnerability. By isolating the system into a separate network zone, access to the vulnerable service or system is severely restricted, drastically reducing its attack surface. This containment strategy limits the number of potential attackers who can reach the system and prevents an exploit from easily propagating to other network resources, thereby minimizing the overall risk.

• ✗

  Encrypt all data at rest on the system

  Why it's wrong here

  Encrypting all data at rest on the system primarily addresses the confidentiality of information. While essential for protecting sensitive data from unauthorized disclosure if the storage media is physically stolen or accessed directly, it does not prevent an attacker from exploiting a vulnerability to gain control of the system itself. An attacker who successfully exploits a system vulnerability could still manipulate processes, corrupt data, or disrupt services, even if the data at rest remains encrypted.

Go deeper

Related to this question