2.3 Describe the Process of Evaluating the Security Posture of an Asset 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An organization is evaluating the security posture of its backup systems. The backups contain sensitive data and are stored both on-premises and in the cloud. The organization has a limited security team and must prioritize its efforts. The on-premises backups are protected by a firewall, while the cloud backups rely on the cloud provider's security. What is the most important consideration for risk scoring?

   • AThe total amount of data stored in each location.
   • BThe likelihood and impact of a breach for each backup location, considering the different controls in place.
   • CThe cost of the backup storage.
   • DThe age of the backup data.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team has completed a posture assessment and identified multiple vulnerabilities across several assets. The team has limited remediation resources and must decide which vulnerabilities to address first. The team has the following findings: a critical vulnerability in a public-facing web server, a high vulnerability in an internal database, and a medium vulnerability in a low-priority internal application. What is the most appropriate prioritization strategy?

   • AAddress all vulnerabilities simultaneously, regardless of resources
   • BPrioritize the low-priority application first because it is easier to fix
   • CPrioritize the public-facing web server first, then the internal database, and finally the low-priority application
   • DPrioritize the internal database first because it contains sensitive data
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company is evaluating the security posture of its customer database. The database is protected by a firewall, encryption at rest, and role-based access control (RBAC). The security team wants to determine if these controls are adequate. What should they do next?

   • ARemove the existing controls to see if any security incidents occur.
   • BTest the effectiveness of each control against known attack patterns and verify that they are configured correctly.
   • CDocument the controls and move to risk scoring without further testing.
   • DImmediately implement additional controls because the existing ones are likely insufficient.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of reporting security posture findings?

   • ATo satisfy the requirements of all regulatory frameworks
   • BTo replace the need for ongoing monitoring
   • CTo automatically remediate all identified vulnerabilities
   • DTo communicate the current security state and identified risks to stakeholders
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hospital is evaluating the security posture of its patient portal, which stores electronic health records (EHR). The portal is internet-facing and processes credit card payments. The security team has limited time and must prioritize which assets to assess first. Which asset should be classified as the highest criticality for the initial security posture evaluation?

   • AThe employee laptop of a nurse, because it is used daily
   • BThe internal file server, because it stores more data by volume
   • CThe network printer, because it is on the internal network
   • DThe patient portal, because it handles sensitive health data and is internet-exposed
   Reveal Solution Discussion Select an answer first