Input for an Information Security Management System (ISMS) CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key component of an Information Security Management System (ISMS)?

   • AA network firewall configuration
   • BA single security software product
   • CA set of security policies and procedures
   • DAn annual security awareness training session
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a security test, a tester discovers that the intrusion detection system (IDS) did not alert on a known exploit attempt. The tester captures network traffic and logs showing the exploit. How should this information be used within the ISMS?

   • ADiscard the evidence because the test did not cause a real incident.
   • BReport the finding only to the IDS vendor for a software update.
   • CUse the evidence to improve the IDS detection rules and update the incident response playbook.
   • DClassify the finding as a false positive and take no further action.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An internal audit is scheduled, and the ISMS manager wants to use security testing results as evidence of compliance. However, some findings are unresolved and may indicate non-compliance. What is the most appropriate way to handle this situation?

   • ADelay the audit until all findings are resolved.
   • BReclassify the unresolved findings as low risk to minimize their impact.
   • CWithhold the unresolved findings from the auditor to avoid negative findings.
   • DPresent the unresolved findings along with a remediation plan and timeline.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security test engineer completes a penetration test of a financial application and identifies a critical SQL injection vulnerability. The ISMS manager asks for a recommendation on how to handle this finding. Which action best aligns with the ISMS risk management process?

   • AInform only the development team and let them decide on the fix.
   • BRecord the finding in the risk register, assess likelihood and impact, and determine if additional controls are needed.
   • CImmediately patch the application and close the finding without further analysis.
   • DDelete the finding from the report to avoid negative audit findings.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security test reveals that a newly deployed application has several high-severity vulnerabilities. The development team fixes the vulnerabilities, but the ISMS manager wants to ensure the fixes are effective and do not introduce new issues. What should be done?

   • AAccept the fixes based on the development team's report.
   • BUpdate the risk register to reflect the fixes as implemented.
   • CClose the findings and move on to the next project.
   • DConduct a retest of the application to verify the fixes and check for regressions.
   Reveal Solution Discussion Select an answer first