ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
A static analysis scan flags a third-party library used by your SaaS platform as affected by a newly published CVE with a base CVSS score of 9.8. Your application never calls the vulnerable function, and runtime controls prevent loading the related module. Under sound vulnerability management practice, what is the most appropriate next action?
Immediately take the service offline and upgrade the library in production without further analysis.
Inform all end users that they must patch their clients because the vulnerability lies outside the service's responsibility.
Mark the vulnerability as a false positive and suppress future alerts for this CVE permanently.
Document how current controls limit exploitability, perform a contextual risk assessment, and schedule remediation based on the residual risk.
Good vulnerability management requires more than reacting to raw CVSS numbers. After discovery, each vulnerability should be triaged for contextual risk: whether the vulnerable code is reachable, whether compensating controls exist, potential business impact, and required effort to remediate. Documenting this assessment allows the team to justify the priority assigned and schedule the fix accordingly. Forcing an emergency upgrade without analysis can introduce instability. Simply dismissing the finding or shifting responsibility to customers ignores due-diligence requirements and may leave residual risk unmanaged.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a CVE?
Open an interactive chat with Bash
What does a CVSS score represent?
Open an interactive chat with Bash
What is a contextual risk assessment in vulnerability management?
Open an interactive chat with Bash
What is CVSS and why is it important?
Open an interactive chat with Bash
What does contextual risk assessment involve?
Open an interactive chat with Bash
How do runtime controls mitigate vulnerabilities?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)