SSCP Certification SSCP Risk Management Process 3

Question 1

A security team discovers that a critical server has an open vulnerability but the vendor has not yet released a patch. The team implements additional network monitoring and restricts access to the server. This is an example of:

Accepted Answer

Compensating controls

Answer

Compensating controls are alternative security measures implemented when primary controls cannot be applied, such as when a patch is unavailable.

Question 2

In the context of SSCP risk management, what does the term 'residual risk' mean?

Accepted Answer

The risk remaining after controls have been applied

Answer

Residual risk is the remaining risk exposure after all planned security controls and risk treatments have been implemented.

Question 3

Which of the following best describes the relationship between threats, vulnerabilities, and risk?

Accepted Answer

A threat exploiting a vulnerability creates risk

Answer

Risk arises when a threat (potential harm source) has the ability to exploit a vulnerability (weakness) — no vulnerability means the threat cannot realize a risk.

Question 4

An organization decides to discontinue an e-commerce feature because the security risks outweigh the business benefits. This risk response is called:

Accepted Answer

Risk avoidance

Answer

Risk avoidance eliminates the risk by not engaging in the activity that creates the risk, such as discontinuing a risky feature or process.

Question 5

What is the role of a risk owner in a risk management program?

Accepted Answer

To be accountable for monitoring and managing a specific risk

Answer

A risk owner is the designated individual accountable for ensuring that a specific risk is properly monitored, treated, and reported.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Risk Management Process 3