ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

During the Implementation/Assessment phase, the focus is on securely configuring the asset, validating the effectiveness of security controls, and identifying residual vulnerabilities before the asset is made operational. Running an authenticated vulnerability scan and comparing the findings against the organization's approved security baseline directly addresses those objectives.

• Tagging the device in the CMDB and recording vendor EOL information is part of the inventory activity that follows acquisition.
• Purging data with a DoD wipe utility is a disposal activity carried out at end-of-life, not during implementation.
• Submitting a formal Request for Change is a change-management step; although important, it does not by itself assess whether the appliance meets the required security controls. Therefore, conducting a vulnerability scan and validating the results against the baseline is the most appropriate action for this phase.