CISSP Cyber Training Podcast - CISSP Training Program · Shon Gerber, vCISO, CISSP, Cybersecurity Consultant and Entrepreneur

CCT 323: Practice CISSP Questions - Generating Reports - Domain 6

·28 min·1 clip

Sean Gerber says a researcher should coordinate with the researcher to extend disclosure, not rush public release.

1. CISSP Cyber Training Podcast CCT 323 focuses on practice CISSP questions about generating reports and vulnerability management in Domain 6. 2. Sean Gerber hosts the episode and frames it as study support for people preparing for the CISSP exam. 3. The core purpose is to show how to evaluate risk, document exceptions, and choose compensating controls instead of reacting mechanically. 4. Sean starts with an Information Security Buzz article about cybersecurity in 2025 and says the year will be as busy as 2024, if not more so. 5. He names AI-driven threats, cyber insurance changes, quantum resilient encryption, generative AI risks, and DevOps security as major 2025 issues. 6. He also mentions SolarWinds, vetting, continuous monitoring, zero trust, and nation-state cyber warfare as part of the risk landscape. 7. Question 1 asks what to do when a vulnerability scan shows high-severity findings that are outdated and unlikely to be exploited in the environment. 8. Sean chooses evaluating exploitability in context, documenting the issue, and using compensating controls instead of blindly remediating or deleting findings. 9. Question 2 covers a business-critical system that cannot be patched because it depends on old software that no longer receives security updates. 10. Sean recommends documenting the exception, using compensating controls, and setting a time-bound remediation plan of six to twelve months. 11. Question 3 presents a zero-day in a publicly available API and a researcher demanding public disclosure within 30 days. 12. Sean advises coordinating with the researcher, privately sharing patch progress, and asking for more time with a realistic timeline. 13. Question 4 shifts to an internal system that is not internet-facing but connects to sensitive data repositories. 14. Sean says the next step is to document the exception, add compensating controls, and reassess periodically because internal exposure still matters. 15. Question 5 describes a security consultant finding a critical vulnerability in a vendor product while the vendor resists public acknowledgment. 16. Sean argues for continued private coordination, a fix timeline, and escalation to senior leadership if the vendor delays further. 17. The episode sounds conversational and exam-focused, with Sean reading scenarios aloud, giving the answer, and then explaining why the other options fail. 18. His tone is informal and repetitive in places, but the format keeps returning to risk, documentation, and communication with stakeholders. 19. People studying CISSP Domain 6 and vulnerability management will get the most value. 20. Listeners wanting a highly polished interview or a short news roundup may skip it.

As heard by us

A CISSP study session that turns vulnerability disclosure into a measured ethics decision.

This CISSP Cyber Training Podcast episode frames vulnerability disclosure as an ethics problem with real pressure behind it. A security consultant finds a critical flaw in a widely used vendor product, sees the risk of a significant data breach, and has to respond when the…

Read the full review in PlayNext →

Why you'd press play

You want CISSP practice that makes ethical judgment feel like a decision you can defend.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CISSP Cyber Training Podcast - CISSP Training Program