220-1102 Question 685
Single answerRisk levelA support technician is reviewing a small company's security findings after a recent internal assessment. One issue shows that the public web server is missing critical security patches, but it is isolated in a DMZ and stores no sensitive data. Another issue shows that several HR laptops containing employee PII are fully patched, but users have local admin rights and no disk encryption. Which finding should be classified as the HIGHEST risk level?
- A
The public web server, because internet-facing systems are automatically the highest risk
- B
The HR laptops, because the potential impact of compromise is high due to sensitive data exposure
- C
Both findings are the same risk level because each represents a security weakness
- D
Neither finding is high risk because one is patched and the other is segmented
Show answer and explanation
Correct answer: B
Explanation
This question tests practical risk assessment, a common A+ Core 2 security topic. In entry-level IT roles, technicians are often expected to help identify which issues should be escalated or remediated first. Risk level is not determined by a single factor such as whether a device is internet-facing or patched. Instead, best practice is to consider likelihood and impact together. Frameworks such as NIST guidance on risk management emphasize evaluating threats, vulnerabilities, likelihood, and business impact. In this scenario, the web server has a vulnerability, but compensating controls reduce impact: it is in a DMZ and does not hold sensitive data. By contrast, the HR laptops contain personally identifiable information, grant users elevated privileges, and lack disk encryption. That combination increases both the likelihood of misuse or malware-related compromise and the impact of data exposure if a device is stolen or breached. Therefore, the HR laptops represent the highest risk and should be prioritized.
- A. Incorrect.
Incorrect. Internet exposure increases likelihood, but risk level is based on both likelihood and impact. In this scenario, the web server is segmented in a DMZ and does not store sensitive data, which reduces impact compared with systems holding employee PII.
- B. Correct.
Correct. Risk level is commonly determined by considering both the probability of a threat event and the business impact if it occurs. HR laptops with local admin rights and no disk encryption present a serious risk because compromise or theft could expose sensitive employee data. The presence of PII significantly raises the impact, making this the highest-risk finding.
- C. Incorrect.
Incorrect. Not all security weaknesses carry the same risk. Risk prioritization requires evaluating context, including asset value, data sensitivity, exposure, and existing compensating controls. The two findings differ in impact and protections, so they should not be treated equally.
- D. Incorrect.
Incorrect. Patching and segmentation are helpful controls, but they do not eliminate risk. The HR laptops remain at elevated risk because local admin rights can increase the chance of malware installation or misuse, and the lack of disk encryption means lost or stolen devices could directly expose confidential data.