SkillTestPro | CCNP Security 300-745 SDSI Practice Test 21

CCNP Security 300-745 SDSI Practice Test 21 (Hard) - Modifying Security Designs to Mitigate Risk

CISCO CCNP Security Exam Logo

1 / 10

Which principle should most directly guide a design team's selection of a specific mitigation approach after a risk has been identified and assessed?

Always selecting the single most expensive available control regardless of the assessed risk level or system context

Selecting a mitigation at random with no relationship to the specific risk that was identified

Assuming no mitigation is ever necessary once a risk has been formally documented in an assessment report

Selecting the mitigation that requires the least implementation effort regardless of whether it addresses the identified risk, in accordance with common design practices, which is inconsistent with expected behavior

Selecting a mitigation that reduces the risk to an acceptable level relative to its cost and operational impact, rather than always selecting the technically strongest possible control regardless of proportionality

Ignoring the assessed risk level entirely and applying an identical mitigation to every system regardless of context

2 / 10

Which risk treatment strategy involves formally accepting a residual risk after mitigation, rather than continuing to invest in additional controls, because the remaining risk falls within the organization's defined risk tolerance?

Risk acceptance

Risk avoidance, which involves eliminating the activity that creates the risk entirely rather than accepting a residual amount

Risk denial, which is not a recognized risk treatment strategy and involves ignoring rather than formally accepting risk

Risk fabrication, which is not a recognized risk treatment strategy and has no relationship to formal risk decisions

Risk transfer, which involves shifting the risk to a third party (such as via insurance) rather than formally accepting it internally

Risk amplification, which is not a recognized risk treatment strategy and would increase rather than manage risk

3 / 10

Which design practice would most help ensure that a proposed mitigation for an identified risk does not introduce new, unintended risks of its own (such as a new attack surface or operational fragility)?

Assuming any security control, once selected, is automatically free of any risk or unintended side effect

Assuming a mitigation's effectiveness against the original risk automatically guarantees it introduces no other risk

Deploying the mitigation directly into production with no design review of the mitigation itself

Skipping any evaluation of the mitigation's own architecture since it is assumed to only reduce risk and never introduce new risk, in most deployment scenarios, which is not the standard approach, which does not align with best practices

Selecting the mitigation solely based on vendor marketing claims with no independent architectural review

Reviewing the proposed mitigation's own architecture and implementation for secondary risks before deployment, treating the mitigation itself as subject to design review rather than assuming any control is inherently risk-free

4 / 10

Which risk would most likely result from a design team selecting a mitigation control based solely on compliance checklist requirements without independently validating that the control actually addresses the organization's specific identified risk?

The organization could achieve formal compliance while the underlying risk remains inadequately addressed, since generic checklist requirements may not map precisely to the organization's specific threat and architecture context

The organization's DNS infrastructure would automatically fail as a direct result of selecting a compliance-driven mitigation

Selecting a mitigation based solely on compliance checklists would automatically guarantee the underlying risk is fully addressed

Compliance-driven mitigation selection would automatically exceed the effectiveness of any risk-driven mitigation selection

Compliance-driven mitigation selection would automatically reduce the organization's overall security tooling costs to zero

Selecting a mitigation based solely on compliance checklists would have no relationship whatsoever to the organization's actual risk posture, in a properly maintained environment, based on standard platform behavior, in most deployment scenarios

5 / 10

Which factor would most influence whether a design team chooses to mitigate, transfer, avoid, or accept a specific identified risk?

The average outdoor temperature at the organization's headquarters

The number of parking spaces available at the organization's headquarters

The cost and feasibility of available mitigation options relative to the risk's severity, combined with the organization's defined risk tolerance and any regulatory requirements affecting the decision

The font used in the organization's internal newsletter

The specific brand of coffee served in the risk management team's office

The color scheme configured for the risk treatment decision tracking tool

6 / 10

Which combination of practices would provide an effective, well-governed approach to modifying a security design to mitigate an identified risk?

Selecting the most expensive available mitigation regardless of the risk's assessed severity, in accordance with common design practices, which is not the standard approach, which does not align with best practices, under normal operating conditions, in most deployment scenarios

Leaving residual risk undocumented and informally assumed to be acceptable with no stakeholder sign-off

Deploying the selected mitigation with no independent review of its own architecture or potential secondary risks

Selecting a mitigation proportionate to the assessed risk severity and organizational risk tolerance, independently reviewing the mitigation's own architecture for secondary risks, and formally documenting any accepted residual risk with appropriate stakeholder sign-off

Selecting mitigations based solely on compliance checklist requirements with no independent risk-based validation

Accepting every identified risk by default with no consideration of available mitigation options

7 / 10

Which troubleshooting/process review step would be appropriate if a newly deployed risk mitigation control is found, during a subsequent review, to have introduced significant operational fragility (such as frequent false-positive blocking of legitimate traffic)?

Review the mitigation's configuration and tuning against the actual observed traffic patterns, and adjust the control's thresholds or scope to reduce false positives while still adequately addressing the originally identified risk

Assume the issue is caused by the design team's choice of desktop wallpaper

Immediately remove the mitigation entirely with no adjustment, leaving the originally identified risk fully unaddressed

Assume the issue is unrelated to the mitigation's configuration and only check the office's physical air conditioning system

Assume the issue is caused by the phase of the moon

Assume operational fragility introduced by a mitigation is a deprecated concern no longer relevant to any control

8 / 10

Which statement accurately describes why risk mitigation is generally approached as a proportionate, risk-informed decision rather than a blanket policy of always applying the strongest available control to every identified risk?

Proportionate mitigation and always applying the strongest control are simply two different names for the exact same identical approach with no distinction, which does not align with best practices, which does not align with best practices, which is inconsistent with expected behavior

Proportionate risk-informed mitigation is only relevant for guest network risks and has no bearing on core business-critical risks

The strongest available control is always technically capable of addressing every category of identified risk with no exception

Applying the strongest possible control to every risk regardless of severity would often introduce excessive cost, operational friction, and complexity disproportionate to lower-severity risks, so mitigation effort is scaled to match assessed risk

Proportionate mitigation eliminates the need for any risk assessment prior to selecting a treatment approach

Applying the strongest available control to every risk always results in a net reduction in operational cost and complexity

9 / 10

Which combination of practices would help a design team ensure that risk mitigation decisions remain appropriate as the organization's risk tolerance and threat landscape evolve over time?

Periodically revisiting previously accepted residual risks against the organization's current risk tolerance, reassessing whether existing mitigations remain proportionate to current threat severity, and updating mitigation scope or strength as conditions change

Reviewing mitigation appropriateness only once per decade regardless of how significantly the threat landscape changes

Treating every risk treatment decision as permanent once made, with no future reassessment regardless of how conditions change, in accordance with common design practices, which is not the standard approach, which is inconsistent with expected behavior, in a properly maintained environment

Assuming previously accepted residual risks will always remain within tolerance indefinitely with no review needed

Disabling reassessment of accepted residual risk entirely once the organization believes its risk management program is mature enough to not need it

Assuming the organization's risk tolerance will never change once initially defined

10 / 10

Which design practice would most help a design team validate that a deployed risk mitigation control is actually functioning as intended on an ongoing basis, rather than assuming it remains effective indefinitely once implemented?

Testing the mitigation's effectiveness only once, immediately before initial deployment, with no subsequent validation

Assuming the mitigation will always function correctly indefinitely once it has passed its initial deployment validation

Disabling all ongoing monitoring of the mitigation to reduce the operational overhead of maintaining it

Relying solely on the mitigation vendor's own marketing claims of effectiveness with no independent ongoing validation

Assuming any configuration change made to surrounding systems can never affect the mitigation's continued effectiveness

Establishing periodic testing or monitoring (such as control effectiveness testing or continuous compliance monitoring) that verifies the mitigation continues to function and address the risk as originally intended

Your score is

The average score is 0%