SSCP Risk Identification, Monitoring, and Analysis Practice Question
Which TWO of the following are examples of vulnerability sources? (Choose TWO.)
⚠ Common exam trap
The SSCP exam tests the distinction between threat sources (e.g., natural disasters, human attacks, hardware failures) and vulnerability sources (e.g., software flaws, configuration weaknesses, architectural weaknesses). Candidates often incorrectly select threat events as vulnerability sources; note that CVE is a vulnerability reference/dictionary, not a vulnerability source category.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuration weaknesses
The SSCP exam distinguishes threat sources from vulnerability sources. A vulnerability source is the origin or category from which a weakness arises, such as configuration weaknesses or software flaws. CVE entries are a standardized reference/dictionary of publicly disclosed vulnerabilities, not a source category of vulnerabilities themselves. Environmental disaster, intentional human attack, and hardware failure are threat sources or threat events, not vulnerability sources. Therefore the only valid vulnerability source among the options is Configuration weaknesses (E).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Environmental disaster
Why it's wrong here
Environmental disasters are threat sources, not vulnerabilities.
- ✗
CVE entries
Why it's wrong here
CVE entries are a canonical vulnerability source: MITRE's dictionary assigns each publicly disclosed flaw a unique identifier with severity and affected-product details, feeding scanners and patch prioritisation. This directly satisfies the question's definition of a vulnerability source.
- ✗
Intentional human attack
Why it's wrong here
Intentional human attack is a threat source.
- ✗
Hardware failure
Why it's wrong here
Hardware failure is a threat source, not a vulnerability source.
- ✓
Configuration weaknesses
Why this is correct
Configuration weaknesses count as vulnerability sources because they are flaws introduced by insecure settings, defaults or hardening gaps rather than by software defects. They satisfy the stem's requirement for a source category, sitting alongside poor coding, design flaws and missing patches as an origin of exploitable weakness.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a vulnerability source explicitly based on publicly known flaws?
easy- A.Configuration weaknesses
- B.Hardware failure
- ✓ C.CVEs
- D.Design flaws
Why C: C is correct because Common Vulnerabilities and Exposures (CVEs) are a standardized, publicly maintained list of known security flaws. Each CVE entry explicitly documents a specific vulnerability that has been discovered, verified, and published, making it a direct source of publicly known flaws used for vulnerability identification and remediation.
Variation 2. Which of the following is a common vulnerability source that would be documented in a risk register?
easy- A.Password policies
- B.Intrusion alerts
- C.Firewall logs
- ✓ D.CVE entries
Why D: D is correct because CVE (Common Vulnerabilities and Exposures) entries are standardized identifiers for known security vulnerabilities, making them a direct source of vulnerability information that should be documented in a risk register. A risk register captures identified risks, including specific vulnerabilities, and CVE entries provide the precise technical details needed to assess and track those risks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.