SkillTestPro | CCNP Security 350-701 SCOR Practice Test 8

CCNP Security 350-701 SCOR Practice Test 8 (Hard) - Security Policies, Compliance, and Risk Management

CISCO CCNP Security Exam Logo

1 / 10

Which risk management strategy involves purchasing cyber insurance to offset the potential financial impact of a security incident, rather than attempting to eliminate the underlying risk entirely?

Risk identification

Risk elimination

Risk transfer

Risk acceptance

Risk avoidance

Risk mitigation

2 / 10

Which risk management strategy involves an organization choosing to discontinue a specific business activity entirely because the associated security risk is deemed unacceptable?

Risk acceptance

Risk monitoring

Risk transfer

Risk mitigation

Risk avoidance

Risk quantification

3 / 10

Which document formally defines an organization's overall security objectives and management's commitment to protecting information assets, serving as the foundation for more detailed standards and procedures?

A single incident response ticket

A firewall configuration backup file

A security policy

A vendor's product marketing brochure

A network topology diagram alone with no policy content

A DNS zone file

4 / 10

Which compliance framework is specifically focused on protecting cardholder data for organizations that store, process, or transmit payment card information?

GLBA (Gramm-Leach-Bliley Act) alone with no card data scope

OSHA (Occupational Safety and Health Act)

FERPA (Family Educational Rights and Privacy Act)

PCI DSS (Payment Card Industry Data Security Standard)

HIPAA (Health Insurance Portability and Accountability Act)

COPPA (Children's Online Privacy Protection Act)

5 / 10

Which term describes the calculated exposure resulting from the combination of a threat's likelihood and the potential impact if that threat were realized against a specific asset?

Threat alone, with no consideration of the target asset

Asset value alone, with no consideration of any threat

A firewall rule base

Risk

A patch management schedule

Vulnerability alone, with no consideration of likelihood or impact

6 / 10

Which activity is a core part of a formal risk assessment process within an organization's overall risk management program?

Performing the assessment only once at company founding and never again

Randomly selecting security controls with no analysis of actual threats or assets

Assuming every asset has identical value and identical risk with no differentiation, though this depends heavily on which specific vendor implementation is deployed

Ignoring all previously identified vulnerabilities to save time

Skipping impact analysis entirely and focusing solely on control cost

Identifying assets, threats, and vulnerabilities, then evaluating the likelihood and impact of each identified risk to prioritize treatment

7 / 10

Which type of security control is a written policy requiring background checks for employees handling sensitive data, as opposed to a technical control like a firewall rule?

A compensating control specifically for encryption

A preventive control implemented purely in hardware

A detective control implemented purely in software

A technical control

A physical control

An administrative (procedural) control

8 / 10

Which risk management strategy involves an organization consciously deciding to take no additional action on a low-impact, low-likelihood risk because the cost of mitigation would exceed the potential loss?

Risk acceptance

Risk elimination through activity discontinuation

Risk mitigation

Risk denial with no analysis performed

Risk transfer

Risk avoidance

9 / 10

Which compliance consideration would be most relevant for a US-based healthcare organization handling patient medical records electronically?

PCI DSS requirements focused exclusively on payment card data

FERPA requirements focused exclusively on student education records

COPPA requirements focused exclusively on children's online services, a determination that several security frameworks treat as a secondary consideration

OSHA requirements focused exclusively on workplace physical safety

HIPAA (Health Insurance Portability and Accountability Act) requirements for protecting electronic protected health information (ePHI)

A generic marketing style guide with no regulatory basis

10 / 10

Which practice best demonstrates a mature integration between an organization's risk management program and its ongoing security operations?

Performing risk assessments without ever revisiting or updating them as the environment changes

Basing all security investment decisions solely on vendor marketing materials rather than assessed risk

Treating every identified risk with identical priority regardless of its assessed likelihood or impact

Conducting risk assessments in complete isolation from any operational security team, with no findings ever shared, under the organization's default security policy before any custom tuning is applied

Discarding risk assessment results immediately after the assessment is completed

Using risk assessment findings to directly inform the prioritization of vulnerability remediation, control investments, and monitoring focus areas

Your score is

The average score is 0%