Improving Measurability Within an ISMS CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which action best demonstrates the use of security testing metrics for continuous improvement?

   • ARecording the number of vulnerabilities found in each test in a log
   • BReviewing the percentage of vulnerabilities that were missed by automated scans and then updating the scan rules to improve detection
   • CSetting a target for the number of vulnerabilities to be found in the next test
   • DComparing the current number of vulnerabilities to the baseline and reporting the difference to management
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A security team is evaluating its penetration testing program. They have been tracking the number of vulnerabilities found per test, but the ISMS manager wants a metric that reflects the business impact of the findings. Which metric would best achieve this?

   • ANumber of critical vulnerabilities found that affect systems supporting core business processes.
   • BPercentage of test cases that passed.
   • CTotal number of vulnerabilities found in each test.
   • DNumber of testers who participated in the test.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of establishing a baseline for a security testing metric?

   • ATo set the maximum acceptable level of risk for the organization
   • BTo provide a reference point for comparing future measurements and identifying trends
   • CTo replace the need for ongoing security testing
   • DTo define the exact number of vulnerabilities that will be found in the next test
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to measure the effectiveness of its vulnerability scanning program. They currently track the number of vulnerabilities detected. Which additional metric would best help them assess the program's ability to find real, exploitable issues?

   • AFalse positive rate of the scanner.
   • BNumber of security testers on the team.
   • CAverage time to complete a scan.
   • DTotal number of scans performed per month.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is the best example of a measurable security testing objective aligned with ISMS goals?

   • APerform penetration testing on all critical applications
   • BImprove the security posture of the organization
   • CReduce the average time to remediate high-risk vulnerabilities from 30 days to 15 days by the end of the year
   • DEnsure that security testing is conducted regularly
   Reveal Solution Discussion Select an answer first