SSCP Security Operations and Administration Practice Question
A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?
⚠ Common exam trap
SSCP often tests the tendency to prioritize immediate patching over business continuity, but the correct first step is always risk assessment and compensating controls when downtime is a concern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assess the risk and implement compensating controls if possible
Assessing the risk and implementing compensating controls if possible is the first step because it balances the need to address the critical vulnerability with the business impact of downtime. This approach follows risk management principles: evaluate the severity, exploitability, and potential impact, then apply mitigations such as virtual patching, network segmentation, or increased monitoring until a patch can be safely applied. It is not prudent to ignore or immediately disrupt business operations without analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assess the risk and implement compensating controls if possible
Why this is correct
Assessing risk and applying compensating controls, such as a web application firewall rule or network segmentation, addresses the exposure without rebooting. This satisfies the stem's constraint of avoiding business-hours downtime while the critical 9.8 CVSS vulnerability remains unpatched on the public-facing server.
- ✗
Schedule the patch for the next maintenance window without further analysis
Why it's wrong here
Deferring to the maintenance window leaves a CVSS 9.8 flaw on a public-facing server unmitigated for days, so the first action must be assessing exposure and applying compensating controls. It is tempting because scheduled maintenance is genuinely correct once interim mitigation is in place and the risk has been formally evaluated.
- ✗
Apply the patch immediately during business hours
Why it's wrong here
Patching immediately during business hours causes unplanned downtime and skips the risk assessment and change approval that should precede remediation. It is tempting because rapid patching is genuinely correct for an actively exploited vulnerability where the exposure outweighs the outage cost.
- ✗
Document the exception and ignore the vulnerability
Why it's wrong here
Documenting an exception abandons a CVSS 9.8 public-facing vulnerability without any compensating control, leaving the server exploitable. It is tempting because formal exception documentation is genuinely correct when a compensating control reduces residual risk to an accepted level and remediation is genuinely infeasible.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.