Study. uk . com
  1. Home
  2. All questions
  3. Question 584

CompTIA Security+ study material · question 584 of 611

What must a remediation report state beyond the list of findings?

  1. The CVSS vector for each finding
  2. The rules of engagement for the assessment
  3. The scanner version used
  4. What was fixed, what was accepted, and what remains
Show the answer

Answer: D. What was fixed, what was accepted, and what remains

A scan result with no disposition is not a managed risk, only an observation.

Source: NIST SP 800-115 (NIST) — SP 800-115 § 8 Post-Testing Activities

Challenge yourself on this topic → Study as cards