350-201 Question 59
Select 4A financial organization is conducting an evaluation of the security posture of a newly deployed web application hosted on their infrastructure. As part of the evaluation, the security team wants to ensure the asset is not only protected from potential vulnerabilities but also compliant with organizational policies. Which steps should the team include in their evaluation process?
- A
Conduct vulnerability scans to identify potential weaknesses.
- B
Review and validate the system's compliance with organizational security policies.
- C
Monitor network traffic for signs of ongoing attacks or anomalies.
- D
Perform a risk assessment to prioritize vulnerabilities based on potential impact.
- E
Only rely on vendor-provided security documentation for assessing risks.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
Evaluating the security posture of an asset involves a combination of proactive and reactive measures, including vulnerability scanning, compliance validation, traffic monitoring, and risk assessment. These steps ensure the asset is not only secure but also aligned with organizational standards. Solely relying on vendor documentation does not provide a comprehensive understanding of the asset's security risks.
- A. Correct.
Conducting vulnerability scans is an essential step to identify potential weaknesses in the asset's security posture and is a critical part of the evaluation process.
- B. Correct.
Validating compliance with organizational security policies ensures that the asset adheres to predefined standards and regulatory requirements, which is necessary for maintaining a strong security posture.
- C. Correct.
Monitoring network traffic helps in identifying real-time threats or anomalies that could indicate a compromise. This is an important part of continuous evaluation.
- D. Correct.
Risk assessment is necessary to prioritize vulnerabilities by understanding their potential impact and likelihood, allowing the team to focus on the most critical issues.
- E. Incorrect.
Relying solely on vendor-provided security documentation is insufficient for a thorough evaluation, as it does not account for custom configurations or new vulnerabilities introduced after deployment.