2.3 Describe the Process of Evaluating the Security Posture of an Asset 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is performing a risk assessment for a new cloud-based application that will store customer personal data. The application will be accessible from the internet and will use a third-party identity provider for authentication. The analyst must determine the risk score for the application. Which factor should be given the most weight in the risk score?

   • AThe cost of the application
   • BThe fact that the application is cloud-based
   • CThe use of a third-party identity provider
   • DThe sensitivity of the customer personal data and the potential impact of a breach
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of scoring risks during a security posture evaluation?

   • ATo replace the need for security controls
   • BTo prioritize which risks should be addressed first based on their severity
   • CTo assign a monetary value to the asset
   • DTo eliminate all risks from the asset
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team has completed a posture assessment of a legacy application that is critical to business operations. The assessment found several high-risk vulnerabilities, but the application cannot be taken offline for patching during business hours. The team must report the findings and recommend remediation. What should the report emphasize?

   • APrioritize remediation based on risk score and propose compensating controls for the downtime constraint
   • BSuggest decommissioning the application immediately
   • CRecommend immediate patching during business hours despite the potential outage
   • DReport the vulnerabilities but do not suggest remediation because the application is critical
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of classifying assets based on their criticality and value?

   • ATo identify which assets should be connected to the internet
   • BTo prioritize security efforts and allocate resources to the most important assets
   • CTo satisfy regulatory requirements for asset inventory
   • DTo determine the exact replacement cost of each asset
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is assessing the posture of a web application that handles online payments. The application is behind a WAF and uses TLS encryption. The team has identified a potential vulnerability in the payment processing logic. They need to determine if the existing controls are sufficient. What should they do?

   • AImmediately disable the payment feature to prevent exploitation.
   • BPerform a manual code review and penetration test of the payment logic to verify if the WAF and TLS can be bypassed.
   • CRely on the WAF vendor's documentation to confirm protection.
   • DAssume the WAF and TLS are sufficient because they are industry-standard controls.
   Reveal Solution Discussion Select an answer first