Improving Measurability Within an ISMS CT-STE Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A company wants to measure the effectiveness of its web application security testing program. They currently track the number of vulnerabilities found per test. The ISMS manager wants a metric that better reflects the coverage of the testing. Which metric should they add?

   • ATotal number of security testers on the team.
   • BAverage time to fix a critical vulnerability.
   • CPercentage of application endpoints covered by automated scans.
   • DNumber of security incidents reported by users.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has been tracking the 'time to remediate critical vulnerabilities' for a year. The average is 45 days. The ISMS manager wants to set a baseline for this metric to drive improvement. What is the most appropriate baseline?

   • A60 days, to allow for unexpected delays.
   • B45 days, the current average.
   • C30 days, a more aggressive target.
   • DThe industry average of 30 days.
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   Which statement best describes a measurable security testing objective?

   • AA statement that defines the testing scope and lists the tools to be used
   • BA statement that describes the overall mission of the security testing team
   • CA statement that specifies a target value for a metric, such as reducing critical vulnerabilities by 20% within six months
   • DA statement that lists the security controls to be tested and the expected pass/fail criteria
   Reveal Solution Discussion Select an answer first