SSCP Security Operations and Administration Practice Question
A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CVSS score and asset criticality
Patch prioritization should consider both the severity of the vulnerability (CVSS score) and the criticality of the asset being patched. A high CVSS score on a critical asset poses the greatest risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CVSS score and asset criticality
Why this is correct
CVSS score indicates vulnerability severity, and asset criticality determines business impact. Together, they provide a risk-based priority.
- ✗
Number of systems affected and patch size
Why it's wrong here
While number of systems matters, it should be weighted with criticality; patch size is irrelevant.
- ✗
Age of the patch and vendor reputation
Why it's wrong here
Age and vendor reputation are less important than the risk posed by the vulnerability.
- ✗
Cost of the patch and availability of workarounds
Why it's wrong here
Patches are typically free; cost is not a factor. Workarounds may be considered, but not as the primary factor.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.