Improving Holistic View of an ISMS CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a security test, a tester discovers that a control documented in the ISMS is not actually implemented. What should the tester do to support the ISMS process?

   • AOnly report the finding if the control is critical to the business.
   • BReport the finding so that the ISMS documentation can be updated and the control implemented.
   • CIgnore the finding because the control was documented and assumed to be in place.
   • DImplement the control immediately without updating the ISMS documentation.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is building a holistic security testing strategy. They have a mix of on-premises and cloud systems, and a remote workforce. What should the strategy include to be truly holistic?

   • AFocus on penetration testing of all systems, regardless of location.
   • BTest technical controls, remote access policies, and employee security awareness.
   • COnly test the cloud systems since they are the most modern.
   • DPrioritize testing of remote access over all other areas.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an ISMS risk assessment, a new critical vulnerability is discovered in a customer-facing application. According to ISMS processes, what is the most appropriate next step?

   • AImmediately schedule a penetration test to verify the vulnerability.
   • BWait for the next scheduled security test to address the vulnerability.
   • CInform the development team and ask them to fix it without updating the risk register.
   • DUpdate the risk register and implement a temporary control to mitigate the risk.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization's ISMS risk assessment has identified two high-risk areas: a public-facing web application and an internal HR system. The web application is exposed to the internet, while the HR system contains sensitive employee data. The testing budget allows for only one full-scale test this quarter. How should the security team decide which area to test?

   • ATest the HR system because it contains sensitive data and has a higher impact if breached.
   • BConduct a quick risk assessment to compare the likelihood and impact of both areas, then test the one with the highest risk score.
   • CTest the web application because it is exposed to the internet and has a higher likelihood of attack.
   • DSplit the budget equally and test both areas partially.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After a penetration test, the security team needs to report findings to different stakeholders. The board of directors wants a high-level overview, while IT operations needs technical details. How should the security team communicate the results?

   • AOnly report the critical findings to the board and keep the rest confidential.
   • BPresent the report only to the CISO to avoid unnecessary alarm.
   • CProvide a tailored summary to the board focusing on business impact and risk, and a detailed technical report to IT operations.
   • DSend the same detailed technical report to all stakeholders to ensure transparency.
   Reveal Solution Discussion Select an answer first