Most Important Consideration for Vulnerability Scanning Critical Infrastructure?
Short answer
D Ensure vulnerability scans do not degrade system performance to maintain continuous operation of critical IT infrastructure.
Question
Key Takeaways
This question tests your ability to prioritize business continuity over technical convenience, with the common trap being choosing off-peak scheduling instead of addressing direct performance impact.
When implementing vulnerability scans on critical infrastructure, preventing operational disruption is the top priority. Community consensus confirms that maintaining system performance outweighs scheduling or cost factors.
Common mistake: Option B is frequently chosen because it seems practical, but it fails to address the fundamental requirement that scans must never degrade critical system performance regardless of timing.
Expert Analysis
Why the Answer Is Correct
Vulnerability scanners consume significant CPU cycles and network bandwidth, which directly threatens availability. ISACA’s CISA framework mandates that security assessments must never compromise the continuous operation of mission-critical assets. Therefore, guaranteeing zero performance degradation is the primary control objective before any other implementation step.
Why the Other Options Are Wrong
Cost-effectiveness (A) is a secondary administrative concern that cannot override operational risk. Scheduling during non-peak hours (B) is merely a tactical workaround that does not eliminate the inherent resource consumption of scanning tools. Penetration testing (C) is a subsequent validation phase that relies on established scanning baselines rather than dictating initial deployment criteria.
Community Comment Notes
Candidate discussions consistently validate D as the optimal choice for enterprise environments. Comment [1] and [2] explicitly confirm that preserving system integrity takes precedence over logistical convenience. While comment [3] suggests off-peak execution, it ultimately acknowledges that performance preservation remains the underlying rationale for that recommendation.
Official Reference
https://csrc.nist.gov/publications/detail/sp/800-115/final
This link opens the official vendor documentation in a new tab.
Exam Strategy
When answering CISA questions involving critical infrastructure, always prioritize business continuity and operational stability over technical optimizations or cost savings. Look for options that prevent service disruption before considering scheduling or budget constraints.
Frequently Asked Questions
Why isn't off-peak scanning the best answer for critical infrastructure?
Does cost-effectiveness matter more than system stability during vulnerability assessments?
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
PurpleParrot 👍 3 Answered DOption D is the correct answer
-
Swallows 👍 1 Answered BVulnerability scanning of critical infrastructure must be performed without affecting the normal operation of the system. Scanning during peak hours may result in insufficient network bandwidth and resources, which may affect system performance. Therefore, it is recommended to select off-peak hours for scanning.
-
choboanon 👍 1 Answered DD is correct. First determine if it's an issue, not jump straight to off-hours scanning
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →