3.3 - Perform Security Assessments and Vulnerability Management Activities SSCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a compensating control?

   • AChanging a default password to a strong one.
   • BImplementing additional network segmentation to limit exposure when a patch cannot be applied immediately.
   • CDeleting a vulnerable application from the system.
   • DApplying a vendor-supplied security patch.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes the primary purpose of implementing a risk management framework such as NIST RMF or ISO 31000 in an organization?

   • ATo guarantee that all risks are eliminated and no residual risk remains.
   • BTo provide a structured and consistent process for identifying, assessing, and mitigating risks across the organization.
   • CTo ensure compliance with a specific vendor's product requirements.
   • DTo replace the need for technical security controls by relying on policy and procedure.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A vulnerability scan of an organization's environment identifies the following findings: a critical vulnerability on a public-facing web server (CVSS 9.8), a high vulnerability on an internal file server (CVSS 7.5), and a medium vulnerability on a development workstation (CVSS 5.0). The organization has limited remediation resources. What should be prioritized FIRST?

   • AThe medium vulnerability on the development workstation.
   • BAll vulnerabilities equally, to ensure comprehensive remediation.
   • CThe high vulnerability on the internal file server.
   • DThe critical vulnerability on the public-facing web server.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A security architect is reviewing the architecture of a new cloud-based application. The application consists of a web front end, an application server, and a database. The architect notices that the database is accessible from the internet via a public IP address. The application server also has a public IP address. The architect recommends removing the database's public IP and placing it on a private subnet. What is the primary security benefit of this change?

   • AIt reduces the attack surface by limiting direct access to the database from the internet.
   • BIt eliminates the need for encryption in transit.
   • CIt simplifies compliance with data residency requirements.
   • DIt improves database performance by reducing network latency.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary difference between a vulnerability scan and a penetration test?

   • AA vulnerability scan identifies potential vulnerabilities, while a penetration test exploits them to prove impact.
   • BA vulnerability scan is required by law, while a penetration test is optional.
   • CA vulnerability scan is automated, while a penetration test is always manual.
   • DA vulnerability scan is performed by internal staff, while a penetration test is always outsourced.
   Reveal Solution Discussion Select an answer first