3.3 - Perform Security Assessments and Vulnerability Management Activities SSCP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is planning an assessment of a new customer-facing web application. The goal is to identify as many exploitable vulnerabilities as possible, including logic flaws that automated scanners might miss. The team has a limited budget and a two-week timeline. Which approach best meets the goal?

   • AUse a combination of network and web application vulnerability scanners.
   • BConduct a full penetration test with manual testing techniques.
   • CPerform a security audit of the code and configuration.
   • DRun an authenticated vulnerability scan and manually review the results.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A security analyst has completed a vulnerability scan and identified a critical vulnerability in a public-facing web server. The analyst needs to communicate the findings to the IT manager and the system owner. What is the most effective way to communicate the risk?

   • AProvide a detailed technical report with exploit code.
   • BProvide a summary that includes the risk rating, potential impact, and recommended actions.
   • CProvide a verbal update and wait for questions.
   • DProvide a list of all vulnerabilities found, sorted by CVSS score.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary goal of vulnerability remediation?

   • ATo mitigate identified vulnerabilities through patching, configuration changes, or compensating controls.
   • BTo document vulnerabilities for reporting purposes.
   • CTo identify new vulnerabilities.
   • DTo assign responsibility for vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A security team has identified a critical vulnerability in a legacy application that is essential to business operations. The application cannot be patched because the vendor no longer provides support. The team has implemented a compensating control, but the control is not fully effective. What is the most appropriate next step?

   • ADecommission the application immediately.
   • BEscalate the risk to management and request a decision on risk acceptance or additional funding.
   • CIsolate the application from the network to reduce exposure.
   • DAccept the residual risk and document the decision.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is asked to assess the security of a new mobile application. The team has access to the source code and a test environment. The goal is to identify common coding flaws and configuration issues before release. Which testing method is most appropriate?

   • AConduct a penetration test against the production environment.
   • BPerform a static code analysis and a vulnerability scan of the test environment.
   • CRun a social engineering test on the development team.
   • DReview the architecture design documents only.
   Reveal Solution Discussion Select an answer first