2.3 Describe the Process of Evaluating the Security Posture of an Asset 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A healthcare organization is evaluating the security posture of its electronic health record (EHR) system. The system is protected by network segmentation, encryption, and access controls. However, the organization has a limited budget and cannot implement all recommended controls. The security team must decide which control to prioritize based on the most significant risk reduction. Which approach should they take?

   • AImplement the cheapest control first to save budget for other initiatives.
   • BConduct a risk analysis to identify which control addresses the highest-risk vulnerabilities and implement that one first.
   • CAsk the EHR vendor to recommend a control without further analysis.
   • DImplement all controls equally to avoid leaving any gap.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which activity is part of a threat and vulnerability assessment for an asset?

   • AIdentifying potential threat sources and scanning the asset for known weaknesses
   • BCalculating the financial value of the asset
   • CImplementing security patches to fix discovered issues
   • DDefining the organization's security policies
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is evaluating the posture of a web application. They have identified a SQL injection vulnerability that could lead to data exposure. The application is internet-facing and processes sensitive customer data. The analyst needs to score this risk. Which factor should be weighted most heavily?

   • AThe number of developers who worked on the application.
   • BThe age of the web application framework.
   • CThe cost of the web application license.
   • DThe likelihood of exploitation and the potential impact on customer data confidentiality.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In risk analysis, what does the risk score for an asset typically represent?

   • AThe cost of the asset's security controls
   • BThe asset's criticality classification
   • CThe number of vulnerabilities found on the asset
   • DThe combination of the likelihood of a threat exploiting a vulnerability and the impact of that event
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is evaluating the security controls of its remote access solution. The solution uses a VPN with certificate-based authentication and a network access control (NAC) system that checks device compliance. The team finds that the NAC system is not enforcing compliance checks for all devices because some devices are not managed by the company. What is the most appropriate finding?

   • AThe NAC control is partially effective because it checks managed devices, but unmanaged devices may introduce risk
   • BThe VPN certificate authentication is sufficient, so the NAC is not necessary
   • CThe remote access solution is secure because the VPN is encrypted
   • DThe NAC should be disabled because it is not working for all devices
   Reveal Solution Discussion Select an answer first