A municipal SOC learns of emerging VPN appliance flaws from open-source intel, an ISAC bulletin, and a paid feed, then raises patch priority for city remote-access gateways. What vulnerability-management practice is the team applying?
Select an answer to reveal the explanation.
Short Explanation
Threat feeds are the early-warning radio for city IT—OSINT, ISACs, and commercial intel tip you off that a VPN bug is hot, so you bump those boxes up the queue. You are folding outside intel into how you find and prioritize vulns, not shutting remote access forever or waiting a year.
Full Explanation
Threat intelligence incorporation is how a municipal SOC turns external early warning into vulnerability-management action. Open-source reporting, ISAC bulletins, and commercial feeds surface actively exploited VPN appliance flaws faster than waiting for the next scheduled compliance scan. Feeding those indicators into identification and prioritization raises remote-access gateways in the patch queue when exposure and weaponization are high, aligning scarce change windows with citizen and staff remote-work risk rather than treating every CVE as equal.
Disabling every VPN concentrator until in-person reauthentication is a blunt availability hit that may be appropriate in extreme incident containment but is not the vulnerability-management practice described; the scenario is about intel-driven prioritization, not mass lockout. Ignoring external intel and waiting only for annual scans leaves known, actively exploited issues unaddressed for months. A one-time password reset campaign addresses credential hygiene, not appliance firmware flaws, and does not replace vulnerability management.
Exam caveat: threat intel informs risk scoring and SLA urgency; it does not by itself remediate. Correlate vendor advisories, CVE IDs, and asset inventory so you patch the right municipal gateways, and distinguish intelligence-driven prioritization from blind emergency shutdowns.
Operational check: subscribe ISAC and vendor channels to a monitored inbox or SOAR playbook, map incoming VPN CVEs to the asset CMDB, auto-elevate critical internet-facing appliances, and document who approved the accelerated change window.