2.3 Describe the Process of Evaluating the Security Posture of an Asset 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After completing a security posture assessment, a security analyst must present the findings to the executive team. The assessment found that a critical database has a high-risk vulnerability that could lead to data loss. The remediation requires a significant investment and a maintenance window. What is the most effective way to report the findings?

   • AOnly report the risk score and let the executives decide
   • BProvide a detailed technical explanation of the vulnerability and the exact patch to apply
   • CPresent the risk in business terms, such as potential financial and reputational impact, and propose a phased remediation plan
   • DRecommend immediate remediation without discussing the cost or impact
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which action is an example of a remediation recommendation that might be included in a security posture report?

   • ADocumenting the asset's purchase price
   • BUpdating the asset's depreciation schedule
   • CChanging the asset's physical location
   • DApplying a security patch to address a known vulnerability
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team is evaluating the posture of a critical application server. They have identified that the server has a host-based firewall enabled, but they are unsure if it is properly configured. What is the best way to evaluate the effectiveness of this control?

   • AAssume the firewall is effective because it is enabled.
   • BReview the firewall rules and test them with network scans from allowed and disallowed sources.
   • CCheck the firewall logs for past attacks.
   • DDisable the firewall temporarily to see if any issues arise.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multinational corporation is evaluating the security posture of its data centers. The data centers are located in different countries with varying data protection laws. The corporation must prioritize which data center to assess first. Which factor should be given the most weight?

   • AThe number of employees working in each data center.
   • BThe physical size of the data center.
   • CThe criticality of the data stored in each data center and the potential regulatory impact of a breach.
   • DThe age of the data center's cooling system.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is classifying its assets for a security posture evaluation. The company has a development environment that contains source code for a new product, a production environment that hosts the product, and a test environment that is used for QA. The source code is considered a trade secret, and the production environment is critical to revenue. The test environment is not critical. Which asset should be classified as the highest criticality?

   • AThe production environment, because it directly generates revenue and is critical to business operations
   • BThe test environment, because it is used for QA
   • CAll environments should be classified equally because they are all part of the product lifecycle
   • DThe development environment, because the source code is a trade secret
   Reveal Solution Discussion Select an answer first