Input for an Information Security Management System (ISMS) CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After a security test, the test engineer prepares a report with technical details of vulnerabilities. The ISMS manager needs to present the results to the board of directors. What is the most appropriate way to communicate the findings?

   • APost the full report on the company intranet for all employees.
   • BProvide the full technical report to the board for transparency.
   • CShare the report only with the IT department and exclude the board.
   • DSummarize the findings in business terms, focusing on risk levels and recommended actions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do security testing inputs feed into the continuous improvement cycle of an ISMS?

   • ABy automatically implementing all improvements.
   • BBy identifying areas for corrective and preventive actions.
   • CBy providing a final certification for the ISMS.
   • DBy eliminating the need for management reviews.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of an input that security testing provides to an ISMS?

   • AA list of approved security vendors
   • BA budget allocation for security tools
   • CA new security policy document
   • DA list of identified vulnerabilities and their potential impact
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization has implemented a security control that is expensive to operate. The ISMS manager wants to evaluate whether the control is worth the cost. Which combination of security testing inputs would provide the most useful information for this decision?

   • AThe number of attacks blocked by the control and the potential impact of those attacks.
   • BThe control's configuration settings and the vendor's documentation.
   • CThe control's uptime and the number of false positives it generates.
   • DThe number of vulnerabilities found by the control and the cost of the control.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the context of ISMS risk management, what role do security testing results play in risk evaluation?

   • AThey are only used after a risk has been accepted.
   • BThey automatically accept or reject all risks.
   • CThey provide data to help determine whether the level of risk is acceptable.
   • DThey replace the need for risk acceptance criteria.
   Reveal Solution Discussion Select an answer first