3.3 - Perform Security Assessments and Vulnerability Management Activities SSCP Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A security team is conducting a vulnerability scan of a network that includes both Windows and Linux servers. The scan report shows a critical vulnerability in a Windows server that is not present in the Linux servers. The team needs to prioritize remediation. What is the most important factor to consider?

   • AThe CVSS score of the vulnerability.
   • BThe criticality of the Windows server to business operations.
   • CThe age of the vulnerability.
   • DThe number of Linux servers affected.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key consideration when assessing the risk posed by a third-party supplier?

   • AThe supplier's office location and employee count.
   • BThe supplier's marketing budget.
   • CThe supplier's access to the organization's data and systems.
   • DThe supplier's stock price.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is about to sign a contract with a new cloud service provider that will host customer data. The company's risk management framework requires that all third-party providers be assessed before data is transferred. The provider has passed a security questionnaire and provided a SOC 2 report. What should the company do NEXT to complete the supplier risk review?

   • ARequire the provider to implement additional controls before signing the contract.
   • BReview the SOC 2 report and map its controls to the company's security requirements and risk tolerance.
   • CAccept the provider's security posture based on the SOC 2 report and proceed with the contract.
   • DConduct an on-site audit of the provider's facilities.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is most likely to be part of an internal risk review?

   • AReviewing firewall rule changes to ensure they align with security policy.
   • BConducting a penetration test against the production environment.
   • CInstalling new security software.
   • DNegotiating contracts with new suppliers.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which factor is most important when prioritizing vulnerabilities for remediation?

   • AThe number of vulnerabilities found in the scan.
   • BThe age of the vulnerability.
   • CThe criticality of the affected asset.
   • DThe name of the vendor that disclosed the vulnerability.
   Reveal Solution Discussion Select an answer first