SSCP Risk Management & Compliance 3

Question 1

What is the main difference between a vulnerability and a threat in risk terminology?

Accepted Answer

A vulnerability is a weakness that can be exploited; a threat is a potential danger that could exploit it

Answer

A vulnerability is a malicious actor; a threat is a software flaw

Answer

A vulnerability quantifies financial loss; a threat describes the attack vector

Answer

A vulnerability is external; a threat is always internal

Question 2

Which recovery objective defines the maximum age of data that must be restored after a disruption?

Accepted Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Service Delivery Objective (SDO)

Question 3

A company processes EU citizen data. Which regulation imposes strict requirements on data protection, consent, and breach notification within 72 hours?

Accepted Answer

GDPR (General Data Protection Regulation)

Answer

CCPA (California Consumer Privacy Act)

Answer

PIPEDA (Personal Information Protection and Electronic Documents Act)

Answer

GLBA (Gramm-Leach-Bliley Act)

Question 4

Which type of audit assesses whether security controls are operating effectively and in compliance with stated policies?

Accepted Answer

Compliance audit

Answer

Penetration test

Answer

Vulnerability scan

Answer

Code review

Question 5

What is the purpose of a Statement of Applicability (SoA) in an ISO 27001 implementation?

Accepted Answer

To document which Annex A controls are applicable, selected, and implemented

Answer

To list all known vulnerabilities discovered during a penetration test

Answer

To define the organization's acceptable use policy for end users

Answer

To specify firewall rules for protecting the DMZ

Question 6

Which risk treatment option eliminates a risk entirely by discontinuing the activity that causes it?

Accepted Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transference

Answer

Risk acceptance

Question 7

During a risk assessment, an analyst determines that a web application has a critical vulnerability with a high likelihood of exploitation. Which step should occur NEXT?

Accepted Answer

Identify and evaluate appropriate risk treatment options

Answer

Immediately shut down the web application

Answer

Publish the vulnerability details to inform users

Answer

Accept the risk and document it in the risk register without further action