What is the purpose of a vulnerability management lifecycle, and what are its major stages?

What is the purpose of a vulnerability management lifecycle, and what are its major stages?

• A. Identify, prioritize, remediate, verify, and close vulnerabilities. Stages: discovery, risk scoring, remediation planning, patch/application, verification, and reporting.
• B. Only detect vulnerabilities without remediation.
• C. Identify, assess, and report vulnerabilities with no remediation or verification.
• D. It is a one-time assessment.

Answer: (A)

The purpose of a vulnerability management lifecycle is to reduce risk by actively managing weaknesses from discovery through to verification and closure, in a continuous, prioritized way. It’s not enough to just find flaws; you must decide which are most dangerous, fix them, and confirm the fixes worked. The major stages are: - Discovery: scanning and identifying vulnerabilities across systems and assets. - Risk scoring or prioritization: evaluating severity, exploit likelihood, and asset criticality to decide what to address first. - Remediation planning: deciding how to fix or mitigate vulnerabilities, including patches, workarounds, or design/ configuration changes. - Remediation (patching/apply fixes): implementing the chosen fixes on affected systems. - Verification: re-testing or re-scanning to confirm the vulnerabilities are resolved and no new issues were introduced. - Reporting and closure: documenting actions taken, updating stakeholders, and formally closing the vulnerability. Why this fits best: it outlines an end-to-end, actionable process that moves from identification to resolution and confirmation, ensuring vulnerabilities don’t linger and risk is continually reduced. The other options omit remediation, verification, or the ongoing nature of the process, which are essential to effective vulnerability management.

The purpose of a vulnerability management lifecycle is to reduce risk by actively managing weaknesses from discovery through to verification and closure, in a continuous, prioritized way. It’s not enough to just find flaws; you must decide which are most dangerous, fix them, and confirm the fixes worked.

The major stages are:

• Discovery: scanning and identifying vulnerabilities across systems and assets.

• Risk scoring or prioritization: evaluating severity, exploit likelihood, and asset criticality to decide what to address first.

• Remediation planning: deciding how to fix or mitigate vulnerabilities, including patches, workarounds, or design/ configuration changes.

• Remediation (patching/apply fixes): implementing the chosen fixes on affected systems.

• Verification: re-testing or re-scanning to confirm the vulnerabilities are resolved and no new issues were introduced.

• Reporting and closure: documenting actions taken, updating stakeholders, and formally closing the vulnerability.

Why this fits best: it outlines an end-to-end, actionable process that moves from identification to resolution and confirmation, ensuring vulnerabilities don’t linger and risk is continually reduced. The other options omit remediation, verification, or the ongoing nature of the process, which are essential to effective vulnerability management.