Improving Measurability Within an ISMS CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team needs to report the results of a vulnerability assessment to the IT operations team, which is responsible for patching. What is the most useful way to present the findings?

   • AA summary of the total number of vulnerabilities found and the overall risk score.
   • BA chart showing the trend of vulnerabilities over time.
   • CA detailed report of all vulnerabilities with full exploit code.
   • DA prioritized list of vulnerabilities with affected systems and recommended remediation steps.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A security team has completed a penetration test and needs to report the results to both the technical team and the executive management. What is the most effective reporting strategy?

   • ASend the same detailed technical report to both audiences.
   • BSend only the executive summary to both audiences.
   • CPrepare two reports: a detailed technical report for the technical team and a high-level executive summary for management.
   • DPresent the findings in a single meeting with both audiences, focusing on technical details.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A security team is defining objectives for its security testing program. The ISMS manager wants to ensure the objectives are aligned with the organization's goal of reducing cyber risk. Which objective is the most aligned and measurable?

   • AIncrease the number of security tests performed each quarter.
   • BAchieve a 100% pass rate on all security tests.
   • CReduce the number of high-severity vulnerabilities in internet-facing systems by 50% within the next year.
   • DEnsure all security testers are certified.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the most important characteristic of a security testing report for stakeholders?

   • AIt focuses only on positive results to maintain stakeholder confidence
   • BIt presents metrics and findings in a clear, actionable format that supports decision-making
   • CIt uses technical jargon to demonstrate the expertise of the testing team
   • DIt includes all technical details of every test case executed
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team notices that the 'percentage of vulnerabilities remediated within 30 days' has been decreasing over the last three months. What is the most appropriate first step for the ISMS team?

   • AIncrease the remediation target to 60 days to make the metric easier to achieve.
   • BAnalyze the remediation workflow to identify bottlenecks or resource constraints.
   • CBlame the development team for not fixing vulnerabilities quickly enough.
   • DStop tracking the metric because it is not improving.
   Reveal Solution Discussion Select an answer first