What Is the Correct Sequence of Vulnerability-Management Life Cycle Steps?
Given below are different steps involved in the vulnerability-management life cycle. 1) Remediation 2) Identify assets and create a baseline 3) Verification 4) Monitor 5) Vulnerability scan 6) Risk assessment Identify the correct sequence of steps involved in vulnerability management.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
You are tested on whether you know the logical dependency chain of the CEH vulnerability-management phases — the trap is treating monitoring as an opening activity or remediation as the closing one.
The vulnerability-management life cycle begins with identifying assets and creating a baseline, then scans, assesses risk, remediates, verifies and finally monitors. This page confirms option A as the correct ordering and explains why each phase must follow the one before it.
Option B is the most common wrong pick: monitoring sounds like a continuous activity you would start early, and remediation sounds like the last thing you do, but B places monitoring before the scan and remediation after verification, which inverts the post-assessment phases.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A (2 → 5 → 6 → 1 → 3 → 4) mirrors the phase structure taught in CEH Module 5: the pre-assessment phase covers identifying assets and creating a baseline, the vulnerability-assessment phase performs the vulnerability scan, and the post-assessment phase covers risk assessment, remediation, verification and monitoring. The logic is strictly dependency-driven — you cannot scan an asset you have not inventoried, and you cannot rank findings by business risk before the scan produces them. Risk assessment then prioritises what remediation should fix first, verification proves the fix actually worked, and monitoring keeps the baseline current so the cycle repeats. Every phase depends on the output of the previous one, which is exactly the order in option A.Why the Other Options Are Wrong
Option B moves monitoring to position two and pushes remediation to the very end — monitoring without any scan, remediation or verification produces nothing to monitor, and remediation after verification means you verify before you fix anything. Option C remediates immediately after the baseline, before any scanning or risk assessment, so you would be patching blind without knowing which vulnerabilities exist or which matter most. Option D simply lists the numbered items 1 → 6 in the order they were written in the question stem (remediation first), which is not a life cycle at all — it starts by remediating assets that have not yet been identified or scanned. Only A keeps inventory, discovery, prioritisation, fixing, proof and continuous oversight in a defensible sequence.Community Comment Notes
As ethacker2 notes, the CEHv12 book (Module 5, p.534) splits the cycle into pre-assessment, vulnerability assessment and post-assessment phases, which is another way of arriving at the same ordering. Naif2030 offers the useful heuristic that "Monitoring is usually the last step", instantly eliminating options that place step 4 early. LordXander reasons from dependency rather than memorisation: "You need to verify after remediation", which alone rules out B and D. d10f290's tentative vote for B is the classic trap, and no commenter produced a defensible argument for C or D.Official Reference
Exam Strategy
Anchor the cycle on dependencies rather than memorised numbers: inventory → scan → risk-rank → fix → verify → monitor. If an option has monitoring early or remediation last, eliminate it immediately without reading the rest of the sequence.
Frequently Asked Questions
Why isn't monitoring the first step of the vulnerability-management life cycle?
Monitoring is continuous oversight that confirms fixes hold and surfaces new assets or drift, so it follows remediation and verification. Placing it early (option B) leaves nothing meaningful to monitor.
Why must verification come after remediation in option A?
Verification re-tests the finding to prove the patch or configuration change actually closed it. Verifying before remediation, as options B and D do, checks a system that was never fixed.