CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

By CompTIA · Question Mode

QuestionQ19

Vulnerability Management

A vulnerability analyst performs a credentialed vulnerability scan that covers all addressable enterprise assets. After completing the scan, the analyst finds a large number of critical vulnerabilities that cannot be remediated right away. Which of the following are the most likely reasons these vulnerabilities cannot be immediately addressed?

  • A Lack of technical skills, the absence of a test environment, and the absence of an asset inventory
  • B Physical access challenges, the absence of vendor support, and a lack of system documentation
  • C Inaccurate asset inventory, a lack of system documentation, and an absence of authorization
  • D Legacy and proprietary systems, a lack of patch availability, and vendor dependencies
Explanation

Legacy and proprietary systems often cannot be patched without risking system instability or loss of vendor support, and many organizations retain such systems because replacing them is costly or operationally disruptive. In addition, patches for identified vulnerabilities may simply not yet be available from the vendor, and organizations are frequently dependent on third-party vendors to develop, test, and release fixes or to authorize changes before remediation can occur. These factors—legacy/proprietary technology, lack of available patches, and vendor dependency—are the most common real-world reasons that critical vulnerabilities identified during a scan cannot be remediated immediately, as outlined in CompTIA CySA+ vulnerability management guidance.

Community Discussion

No comments yet. Be the first to start the discussion!