2.3 Describe the Process of Evaluating the Security Posture of an Asset 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is performing a risk analysis for a new IoT device deployment. The devices are low-cost and have limited processing power, making it difficult to run endpoint protection. The devices collect non-sensitive telemetry data and are isolated on a separate network. The team must score the risk for these devices. What is the most appropriate risk score?

   • AHigh, because the devices lack endpoint protection
   • BLow, because the data is non-sensitive and the devices are isolated
   • CCritical, because IoT devices are always high risk
   • DMedium, because the devices have limited security capabilities but are isolated and handle non-sensitive data
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is evaluating the security posture of its public-facing web application. The application is protected by a web application firewall (WAF) and requires multi-factor authentication (MFA) for admin access. During the assessment, the team discovers that the application uses an outdated version of a JavaScript library with a known remote code execution vulnerability. What should the team do next in the posture evaluation process?

   • ADocument the vulnerability and assess whether the WAF and MFA controls sufficiently mitigate the risk
   • BImmediately patch the library without further analysis
   • CDisable the WAF to test if the vulnerability is exploitable
   • DReclassify the asset as low criticality to lower the risk score
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of evaluating the security posture of an asset?

   • ATo determine the asset's current security state and identify weaknesses that could be exploited
   • BTo replace all existing security controls with newer ones
   • CTo ensure the asset is compliant with all industry regulations
   • DTo assign a monetary value to the asset for insurance purposes
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team has completed a posture assessment and identified that a critical application has a high-risk vulnerability. The remediation requires a significant investment and a maintenance window. The team must present the findings to the executive board. What is the most effective way to communicate the risk and remediation plan?

   • AState that the application is at risk and ask the board to decide without a recommendation
   • BExplain the potential business impact, such as revenue loss and regulatory fines, and propose a phased remediation plan with clear milestones
   • CProvide a detailed technical report with CVSS scores and exploit code
   • DRecommend immediate remediation without discussing the cost or timeline
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large organization is evaluating the security posture of its fleet of 5,000 endpoints. The endpoints include laptops, desktops, and mobile devices. The security team has limited resources and must complete the evaluation within two weeks. They have a vulnerability scanner that can scan all endpoints, but the scan results are noisy and require manual triage. The team also has a list of critical assets from a recent business impact analysis. What is the most effective approach?

   • APrioritize the critical assets from the BIA, scan them first, and triage those results before expanding to the rest of the fleet.
   • BScan only the mobile devices because they are the most likely to be lost or stolen.
   • CScan all endpoints simultaneously and use automated tools to triage the results without manual review.
   • DDelay the evaluation until more resources are available to scan everything thoroughly.
   Reveal Solution Discussion Select an answer first