nerdexam
(ISC)2

SSCP · Question #36

The "vulnerability of a facility" to damage or attack may be assessed by all of the following except:

The correct answer is D. security budget. Assessing a facility's vulnerability involves examining its current state, past incidents, and existing security measures, but not the budget allocated for security.

Submitted by rachelw· Apr 18, 2026Risk Identification, Monitoring and Analysis

Question

The "vulnerability of a facility" to damage or attack may be assessed by all of the following except:

Options

  • AInspection
  • BHistory of losses
  • CSecurity controls
  • Dsecurity budget

How the community answered

(42 responses)
  • A
    7% (3)
  • B
    2% (1)
  • C
    2% (1)
  • D
    88% (37)

Why each option

Assessing a facility's vulnerability involves examining its current state, past incidents, and existing security measures, but not the budget allocated for security.

AInspection

Inspection involves physically examining the facility for weaknesses in its structure, systems, or procedures.

BHistory of losses

History of losses provides concrete evidence of past successful attacks or incidents, highlighting existing vulnerabilities.

CSecurity controls

Security controls are the existing measures (physical, technical, administrative) in place; their effectiveness and any gaps directly relate to vulnerability.

Dsecurity budgetCorrect

The security budget represents the financial resources available for implementing or improving security measures, but it does not directly assess the vulnerability of a facility itself. Vulnerability assessment focuses on identifying weaknesses that could be exploited, irrespective of the budget spent.

Concept tested: Components of vulnerability assessment

Topics

#Vulnerability Assessment#Risk Management#Security Assessment#Physical Security

Community Discussion

No community discussion yet for this question.

Full SSCP Practice