Security Operations
Question #262
A software development company uncovers a critical security flaw in one of its popular products that could allow attackers to access sensitive user data without authorization. Given the company’s legal and regulatory responsibilities, what should be the IMMEDIATE next step to effectively address this vulnerability?
A. Inform all affected users about the vulnerability promptly, providing clear instructions on how they can protect themselves and minimize risk until a fix is available.
B. Develop and deploy a security patch to remediate the vulnerability as quickly as possible, and instruct users to apply the update to secure their systems.
C. Initiate an internal investigation to determine if the vulnerability has been actively exploited and assess the scope of any data breaches that may have occurred.
D. Consult legal counsel to clarify the company’s disclosure obligations under relevant regulations, understand potential liabilities, and develop a compliant communication strategy.
Domain Concept: Security Operations
This scenario evaluates management-level decision making in Security Operations. In CISSP exam scenarios, evaluate answers through executive governance, risk assessment, life safety, and due diligence before implementing technical controls.
💡 View the Answer & Detailed Explanation
The correct answer to this scenario-based question requires an understanding of the CISSP Managerial Mindset. Register to view our in-depth explanation and access 1100+ adaptive questions completely free.