CompTIA CySA+ (CS0-003)Reporting and CommunicationEasy
A security analyst is reviewing the effectiveness of the organization's security controls based on recent vulnerability scan results. They note that the number of 'High' severity vulnerabilities has decreased by 20% over the last quarter, while the number of 'Medium' severity vulnerabilities has remained constant. Which of the following conclusions can be drawn from this trend regarding the organization's vulnerability management program?
- AThe organization has eliminated all 'High' severity vulnerabilities.
- BThe overall number of vulnerabilities has increased due to new systems.
- CThe focus on remediating critical risks is showing positive results.
- DThere is a need to invest more in vulnerability scanning tools.
Show answer & explanationAnswer & explanation
Correct answer: C. The focus on remediating critical risks is showing positive results.
A 20% decrease in 'High' severity vulnerabilities indicates that efforts to address the most critical risks are being effective, suggesting a positive outcome for the vulnerability management program's focus.
Why the other options are wrong
- A. A 20% decrease does not mean *all* 'High' severity vulnerabilities have been eliminated, only that a significant portion has been addressed.
- B. The current data does not support an increase in overall vulnerabilities; it only shows a decrease in 'High' and constant 'Medium' severity.
- D. The effectiveness of scanning tools is not directly indicated by these remediation trends; the focus is on the remediation process itself.
Vulnerability Management KPI (Severity Reduction)
A metric that tracks the decrease or increase in the number of vulnerabilities categorized by their severity level over time, indicating the effectiveness of remediation efforts.
- Focuses on risk reduction over absolute numbers.
- Prioritizing 'High' and 'Critical' severity is key for immediate impact.
- A decrease in high-severity vulnerabilities indicates positive progress.
Memory trick: Fewer 'Highs' means 'Good Focus, Getting Better'.