C. Incorrect Statement – Not all vulnerabilities require immediate remediation. Risk assessment determines whether controls are necessary. Some vulnerabilities pose low risks and may not need urgent fixes.
A. Correct Statement – Vulnerabilities can be intrinsic (inherent flaws) or extrinsic (caused by external misconfigurations).
B. Correct Statement – Threats must exploit vulnerabilities to cause harm.
This aligns with ISO/IEC 27001:2022 Annex A Control A.8.8 (Management of Technical Vulnerabilities).
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit