Improving Holistic View of an ISMS CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security tester is asked to align testing activities with the ISMS objectives. What is the primary way security testing supports the ISMS?

   • ABy providing evidence that security controls are effective and identifying areas for improvement.
   • BBy replacing the need for regular risk assessments.
   • CBy focusing solely on technical vulnerabilities to simplify the ISMS process.
   • DBy ensuring that all vulnerabilities are eliminated before they are exploited.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small company is implementing an ISMS for the first time. They want to ensure that security testing is integrated from the start. What is the most important first step?

   • AStart testing immediately to identify vulnerabilities before planning.
   • BHire an external penetration testing company to conduct a one-time test.
   • CDefine the scope and objectives of the ISMS, including which assets and processes are in scope.
   • DPurchase the most advanced security testing tools available.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services company is implementing an ISMS aligned with ISO/IEC 27001. The security team has limited testing budget and must prioritize testing activities for the next quarter. Which approach best aligns with the ISMS risk-based approach?

   • ATest only systems that have been recently changed to minimize disruption.
   • BUse a standard testing checklist for all systems to ensure consistency.
   • CTest all systems equally to ensure comprehensive coverage.
   • DPrioritize testing based on the results of the risk assessment, focusing on high-risk assets and controls.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does the ISMS risk-based approach influence the planning of security testing?

   • AIt eliminates the need for testing low-risk systems
   • BIt focuses testing only on external-facing systems
   • CIt determines the scope and depth of testing based on the risk assessment results
   • DIt requires that all systems be tested with equal frequency
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a key component of an Information Security Management System (ISMS)?

   • AA single security tool that automates all security monitoring
   • BA legal requirement that all organizations must implement
   • CA firewall configuration that blocks all unauthorized access
   • DA set of documented policies, procedures, and controls for managing information security risks
   Reveal Solution Discussion Select an answer first