medium10 pts · first answer countsvulnerability-managementrisk-management

When you cannot patch yet

A critical vulnerability affects an old medical device that the vendor will not patch for three months. What is the best interim action?

A.Apply compensating controls such as network isolation, strict allow-lists and extra monitoring, and record the accepted riskB.Do nothing until the patch is releasedC.Mark the vulnerability as a false positive in the scannerD.Install a third-party patch found on a forum

Discussion 0

Join free to post in the discussion.

When you cannot patch yet

Discussion 0

Related questions