Improving Holistic View of an ISMS CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What does a holistic security testing strategy within an ISMS consider?

   • AOnly the security testing team's capabilities and tools
   • BOnly technical vulnerabilities in software and hardware
   • CTechnical, organizational, and process aspects
   • DOnly the requirements of external auditors
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important for a security testing strategy to include organizational aspects?

   • ABecause organizational aspects are the only source of security vulnerabilities
   • BBecause human behavior and security culture significantly affect the effectiveness of technical controls
   • CBecause testing tools cannot detect technical vulnerabilities
   • DBecause organizational aspects are easier to test than technical ones
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization's ISMS has identified that its customer database is a high-risk asset due to regulatory requirements. The security team is planning testing activities. How should they prioritize testing for this asset?

   • AInclude the customer database in every testing cycle, regardless of other priorities.
   • BUse the same testing frequency as for low-risk assets to maintain consistency.
   • CAllocate a larger portion of the testing budget and schedule more frequent tests for the customer database.
   • DTest the customer database only after all other systems have been tested.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is considering implementing an ISMS. The CEO asks how security testing will change once the ISMS is in place. What is the most accurate response?

   • ASecurity testing will become more structured and aligned with risk management and business objectives.
   • BSecurity testing will be performed only by external vendors to ensure independence.
   • CSecurity testing will no longer be needed because the ISMS will prevent all security issues.
   • DSecurity testing will be performed more frequently, but with less documentation.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A multinational company is developing a holistic security testing strategy. They must comply with data protection regulations that require personal data to be stored in specific regions. They also have a global workforce. What is a key consideration for the testing strategy?

   • AUse a single testing location for all data to simplify compliance.
   • BEnsure that testing tools and processes are compliant with data residency requirements.
   • COutsource all testing to a third party to avoid data residency issues.
   • DFocus only on technical testing and ignore data residency, as it is a legal issue.
   Reveal Solution Discussion Select an answer first