SSCP Risk Identification, Monitoring, and Analysis Practice Question
During a vulnerability scan, a tool reports a critical vulnerability on a web server. The system owner claims it is a false positive because the server is not accessible from the internet. However, the server is accessible from the internal network. What is the best course of action?
⚠ Common exam trap
Candidates often assume a server not accessible from the internet is automatically low-risk, ignoring the reality that internal network threats are a primary attack vector in many breaches, and that risk must be evaluated based on the asset’s exposure and criticality within the internal environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the vulnerability manually and if confirmed, remediate according to internal risk
A vulnerability that is exploitable from the internal network still poses a significant risk, as internal threats (e.g., compromised endpoints, malicious insiders) can leverage it. The system owner’s claim that the server is not internet-facing does not negate the need for verification and remediation; internal attack surfaces must be managed according to the organization’s risk appetite. Manual verification ensures the scanner’s report is accurate, and if confirmed, remediation should follow internal risk-based prioritization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk and close the finding
Why it's wrong here
Acceptance should be a formal decision after assessing internal risk; simply assuming it's safe because it's not internet-facing is insufficient.
- ✗
Ignore the finding as the vulnerability scanner is known for false positives
Why it's wrong here
Ignoring without verification is poor practice; even known scanners produce true positives.
- ✗
Remove the server from the network to eliminate the risk
Why it's wrong here
An overly drastic response; the server may be needed for business operations.
- ✓
Verify the vulnerability manually and if confirmed, remediate according to internal risk
Why this is correct
Manual verification confirms whether it's a true positive; if so, remediation should be prioritized based on internal risk.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.