Improving Measurability Within an ISMS CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which metric is most appropriate for quantifying the effectiveness of security testing?

   • ANumber of security test cases executed per week
   • BNumber of security testers with certifications
   • CPercentage of vulnerabilities detected by testing that were later confirmed as real
   • DTotal cost of security testing tools
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A security team has been tracking the 'number of vulnerabilities found per penetration test' for two years. The metric has been steadily increasing, but the ISMS manager is concerned that this may not indicate improvement. What should the team do to better understand the trend?

   • AAnalyze the severity distribution and the percentage of true positives to determine if the increase is meaningful.
   • BReduce the scope of testing to lower the number of findings.
   • CStop tracking the metric because it is confusing.
   • DAssume the increase indicates that the testing program is more effective.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is the best way to present security testing metrics to stakeholders?

   • AProvide a raw data dump of all metrics and findings
   • BSend a detailed technical report to all stakeholders regardless of their role
   • CUse visualizations such as charts and graphs to highlight trends and key findings
   • DVerbally summarize the results without any written documentation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team needs to report the results of a penetration test to the board of directors. The board is not technical and is primarily interested in risk and business impact. Which reporting approach is most appropriate?

   • AProvide the full technical report with all vulnerability details and exploit steps.
   • BOnly report the number of vulnerabilities found and fixed.
   • CPresent a summary of key findings with business impact, such as 'critical financial data exposure' and recommended actions.
   • DShare the raw scan output files for transparency.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is the best example of a baseline value for a security testing metric?

   • AThe organization has a policy that all critical vulnerabilities must be remediated within 30 days
   • BThe security testing team uses a standard methodology for all tests
   • CThe average time to remediate critical vulnerabilities was 25 days in the previous quarter
   • DThe security testing team aims to reduce remediation time to 10 days
   Reveal Solution Discussion Select an answer first