3.3 - Perform Security Assessments and Vulnerability Management Activities SSCP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an architecture risk review, a security architect notices that a new application server is placed in the same subnet as the database server, with no network segmentation. The application server is internet-facing. What is the most significant risk introduced by this design?

   • AIncreased attack surface, allowing an attacker who compromises the application server to directly access the database.
   • BHigher latency for database queries due to network congestion.
   • CInability to apply patches to the database server without affecting the application server.
   • DIncreased difficulty in monitoring network traffic between the application and database.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An internal risk review of a financial application reveals that the organization has implemented multi-factor authentication (MFA) for all user accounts, but the review team finds that MFA is not enforced for service accounts used in automated processes. According to the organization's risk framework, this is a gap. What should the review team recommend?

   • AImplement compensating controls, such as strong passwords and network restrictions, for service accounts.
   • BDisable the service accounts and require manual authentication for all automated processes.
   • CDocument the gap and close the review without a recommendation.
   • DAccept the risk because service accounts are not user accounts.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is implementing a risk management framework to improve its security posture. The framework requires continuous monitoring and periodic risk assessments. The security team has identified a critical vulnerability in a legacy system that cannot be patched. According to the framework, what is the most appropriate action?

   • AAccept the risk and document the decision.
   • BImplement compensating controls and monitor the system closely.
   • CIgnore the vulnerability because the system is legacy.
   • DRemove the system from the network immediately.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary focus of an architecture risk review?

   • AScanning for known vulnerabilities in installed software.
   • BIdentifying design-level security weaknesses in system and network architectures.
   • CReviewing employee training records.
   • DAuditing financial transactions.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In the context of risk management frameworks, what is the primary purpose of the 'risk assessment' step?

   • ATo identify and analyze risks to determine their likelihood and potential impact.
   • BTo document the organization's risk appetite and tolerance.
   • CTo monitor the effectiveness of existing security controls.
   • DTo implement security controls to mitigate all identified risks.
   Reveal Solution Discussion Select an answer first