CISSP Practice Question: In a corporate environment, a security administrator is planning a vulnerability assessment…

Correct Answer: A. To identify and prioritize security vulnerabilities for remediation.

Explanation (CISSP Manager Logic):

A vulnerability assessment is a strategic risk management tool used to identify technical weaknesses before they are exploited. It provides the data necessary to allocate limited resources effectively by prioritizing remediation efforts based on business impact.

By identifying and prioritizing vulnerabilities, you:

• Establish a baseline for the organization's security posture.
• Enable data-driven decision-making for budget and resource allocation.
• Proactively reduce the attack surface before an incident occurs.

While the other options are relevant, they fall short because:

• B: Encryption is a specific technical control used to mitigate risk, not a diagnostic process to identify weaknesses.
• C: Blocking all traffic is a disruptive action that violates the business requirement for availability.
• D: Intrusion detection is a detective control for monitoring active threats rather than a proactive assessment of flaws.

Think like a manager:

Security testing must support business continuity by identifying risks so they can be managed through a structured, prioritized remediation plan.