easyMultiple Choice
SSCP Practice Question: A security analyst is reviewing vulnerability…
A security analyst is reviewing vulnerability scan results and finds a critical vulnerability on a web server. The patch is available but requires a reboot. What should the analyst do first?
⚠ Common exam trap
ISC2 often tests the misconception that a critical vulnerability must be patched immediately regardless of operational impact, tempting candidates to choose 'apply the patch immediately' without considering the risk assessment and change management steps required by the SSCP's risk identification domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assess the exploitability and impact to determine remediation priority
The first step in vulnerability management is to assess the exploitability and business impact of the vulnerability before taking action. Even though a patch is available, the analyst must determine if the vulnerability is actively exploitable in the current environment and what the potential impact would be, as a reboot may cause service disruption. This aligns with the risk-based prioritization approach required by frameworks like NIST SP 800-40 and the SSCP's focus on balancing security with operational continuity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the patch immediately to reduce risk
Why it's wrong here
Applying the patch immediately reboots a production web server without change approval, testing or a maintenance window. It is tempting because patching removes the vulnerability, but the question asks what to do first, and unplanned outage risk precedes remediation, so assessment and scheduling come before deployment.
- ✓
Assess the exploitability and impact to determine remediation priority
Why this is correct
Assessing exploitability and impact first satisfies the stem's constraint that the patch requires a reboot, which may disrupt services. This risk-based triage determines whether emergency remediation or a scheduled maintenance window is appropriate, rather than rebooting a production web server immediately.
- ✗
Re-scan the server to confirm the vulnerability
Why it's wrong here
Re-scanning merely reconfirms a finding that is already known and does not advance remediation. It is tempting as validation, which suits disputed or false-positive results, but here the vulnerability and its patch are confirmed, so the first action is planning the reboot, not repeating the scan.
- ✗
Ignore the vulnerability because the patch is available
Why it's wrong here
Ignoring a critical finding leaves the web server exploitable and abandons the remediation process entirely. It is tempting when a patch exists and downtime is feared, but the analyst must first assess and plan remediation; doing nothing is never the initial step for a critical vulnerability.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.