Improving Measurability Within an ISMS CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which metric is most appropriate for measuring the coverage of security testing?

   • AAverage time to run a single security test
   • BPercentage of critical applications that have been tested in the last 12 months
   • CNumber of security testers on the team
   • DTotal number of vulnerabilities found in the last test
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A security team is selecting metrics for its ISMS. They want to measure the effectiveness of their security testing program. Which combination of metrics would provide the most comprehensive view?

   • ATime to remediate and number of security incidents.
   • BNumber of tests performed and number of testers.
   • CPercentage of systems tested and number of vulnerabilities found.
   • DNumber of vulnerabilities found, percentage of true positives, and time to remediate.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How can security testing metrics be used to drive continuous improvement within an ISMS?

   • ABy reporting metrics to stakeholders without any further action
   • BBy increasing the number of security testers whenever a metric shows a negative trend
   • CBy analyzing trends in metrics to identify areas where testing is less effective and then adjusting the testing strategy
   • DBy setting the same targets for every metric regardless of the results
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team has been running monthly vulnerability scans for six months. They now want to establish a baseline for the metric 'percentage of critical vulnerabilities remediated within 30 days'. What is the most appropriate way to establish this baseline?

   • AAdopt a baseline from a similar company in the same industry.
   • BSet the baseline to 100% to encourage the team to achieve perfect remediation.
   • CUse the average of the last six months' remediation rates as the baseline.
   • DUse the remediation rate from the first month only.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After a year of tracking security testing metrics, a company notices that the 'percentage of vulnerabilities found by internal testing versus external penetration tests' has shifted from 60/40 to 30/70. What is the most appropriate action for the ISMS team?

   • AIgnore the shift because the total number of vulnerabilities found is stable.
   • BInvestigate the cause of the shift, such as changes in testing scope or tooling, before deciding on improvements.
   • CImmediately increase the budget for external penetration testing.
   • DReduce internal testing efforts since external testing is finding more vulnerabilities.
   Reveal Solution Discussion Select an answer first