2.3 Describe the Process of Evaluating the Security Posture of an Asset 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which factor is most important when classifying an asset's criticality to the organization?

   • AThe asset's vendor and the cost of its maintenance contract
   • BThe asset's value to the organization's mission and the impact if it is compromised
   • CThe asset's age and how long it has been in use
   • DThe asset's physical location within the organization's facilities
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is assessing the threat and vulnerability landscape for a critical application. The application is protected by a web application firewall (WAF) and has a strong authentication mechanism. However, the team discovers that the application is vulnerable to a business logic flaw that allows users to manipulate prices. The WAF does not detect this type of attack. What is the most appropriate conclusion about the security posture?

   • AThe application has a significant vulnerability that the existing controls do not mitigate, so the risk remains high
   • BThe WAF and authentication are sufficient because they protect against common web attacks
   • CThe vulnerability is low risk because it requires authenticated access
   • DThe team should disable the WAF because it is not detecting the vulnerability
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst has completed a posture evaluation of a company's internal wiki. The wiki contains non-sensitive operational documentation. The evaluation found a low-risk vulnerability that would require significant effort to fix. The company has limited resources and many other higher-priority projects. What should the analyst recommend?

   • AFix the vulnerability immediately because all vulnerabilities should be remediated.
   • BRecommend decommissioning the wiki to eliminate the risk.
   • CEscalate the issue to the board of directors for a decision.
   • DAccept the risk and document the decision, since the wiki is low-value and the fix effort is high.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is evaluating the security posture of its employee laptops. The laptops are used for remote work and contain sensitive client data. The company has deployed full-disk encryption and a mobile device management (MDM) solution. The security team wants to assess the effectiveness of these controls. What is the most effective method?

   • AAssume the controls are effective because they are widely used in the industry.
   • BReview the MDM vendor's marketing materials to confirm the controls are effective.
   • CConduct a survey of employees to ask if they think the controls are effective.
   • DVerify that encryption is enabled on all laptops and that MDM policies enforce strong passwords and remote wipe capabilities.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is evaluating the security posture of its new cloud-based CRM system. The system stores customer PII and is accessed by sales staff from various locations. The security team is at the threat and vulnerability assessment step. Which activity is most appropriate?

   • ACalculate the total cost of ownership for the CRM system.
   • BCreate a marketing plan for the CRM system.
   • CIdentify potential threat actors and map them to known vulnerabilities in the CRM system.
   • DReview the CRM system's user interface for usability issues.
   Reveal Solution Discussion Select an answer first