After identifying high-risk vulnerabilities in an internal scan, what action is required?

After identifying high-risk vulnerabilities in an internal scan, what action is required?

• A. Do nothing.
• B. Notify management and stop.
• C. Address vulnerabilities and perform rescans to verify resolution.
• D. Address vulnerabilities and perform rescans to verify resolution, with rescans conducted by qualified personnel.

Answer: (D)

After identifying high-risk vulnerabilities, the priority is to remediate them and then verify the fixes with rescans. The key is that the rescans must be performed by qualified personnel to ensure the results are accurate, properly validated, and well-documented for compliance purposes. Simply addressing the issues without verification leaves risk lingering, while stopping after management notification doesn’t resolve the vulnerabilities. So, the best action is to address vulnerabilities and perform rescans to verify resolution, with rescans conducted by qualified personnel.

After identifying high-risk vulnerabilities, the priority is to remediate them and then verify the fixes with rescans. The key is that the rescans must be performed by qualified personnel to ensure the results are accurate, properly validated, and well-documented for compliance purposes. Simply addressing the issues without verification leaves risk lingering, while stopping after management notification doesn’t resolve the vulnerabilities. So, the best action is to address vulnerabilities and perform rescans to verify resolution, with rescans conducted by qualified personnel.