Input for an Information Security Management System (ISMS) CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What type of evidence does security testing provide regarding control effectiveness?

   • AEvidence that controls are compliant with all regulations.
   • BEvidence that controls can be bypassed or that they successfully resist attacks.
   • CEvidence that controls are cost-effective.
   • DEvidence that controls are user-friendly.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In what way do security testing results support internal and external audits?

   • ABy acting as the auditor's final report.
   • BBy eliminating the need for audit interviews.
   • CBy providing documented evidence of control effectiveness.
   • DBy automatically correcting all nonconformities.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How do security testing results inform the risk identification step of risk management within an ISMS?

   • ABy eliminating the need to identify threats.
   • BBy automatically calculating the risk level for each asset.
   • CBy providing a final risk treatment plan.
   • DBy revealing specific vulnerabilities that could be exploited by threats.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security test identifies a vulnerability that was previously reported and supposedly fixed. The ISMS manager is concerned that the continuous improvement process is not working. What is the most likely reason for the recurrence?

   • AThe original fix was not verified by retesting.
   • BThe risk register was not updated after the fix.
   • CThe vulnerability is not important enough to fix.
   • DThe security test was performed incorrectly.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An external auditor requests evidence that the organization's access control policy is being enforced. Which security testing artifact would best support this compliance claim?

   • AA list of all employees who have completed security awareness training.
   • BA network diagram showing the placement of firewalls.
   • CA report of a penetration test that attempted to bypass access controls and failed.
   • DA copy of the access control policy document.
   Reveal Solution Discussion Select an answer first