Question

A CySA+ analyst discovers that although vulnerabilities are consistently identified and scored, remediation efforts stall because no one is clearly accountable for driving fixes across the different business units. Scans run reliably and tickets are generated, but many high-severity findings remain open past their target dates with no escalation. Which vulnerability management program element is MOST likely missing?

Accepted Answer

A defined governance structure that assigns remediation ownership and escalation authority

Answer

A more frequent authenticated scanning schedule to catch findings earlier

Answer

A tuned CVSS environmental scoring model to reduce the number of high findings

Answer

An expanded asset discovery process to identify additional in-scope hosts