Input for an Information Security Management System (ISMS) CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security test identifies a medium-risk vulnerability in a customer-facing portal. The ISMS manager needs to decide whether to disclose this to customers. What is the most appropriate communication approach?

   • AAssess the risk and consult with legal and communications teams before deciding on disclosure.
   • BDisclose the vulnerability to all customers immediately, including technical details.
   • CShare the vulnerability details on social media to be transparent.
   • DDo not disclose the vulnerability to customers because it is only medium risk.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security test simulates a ransomware attack and successfully encrypts files in a test environment. The test team captures detailed logs of the attack. How can this input best support the incident management process?

   • ADelete the logs to avoid confusion with real incidents.
   • BKeep the logs but do not share them with the incident response team.
   • CReport the test as a real incident to test the escalation process.
   • DUse the logs to refine the incident detection rules and train the incident response team.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an appropriate way to communicate security testing results to stakeholders?

   • AA single technical report shared with all employees.
   • BA verbal summary with no written documentation.
   • CA public announcement on the company website.
   • DA tailored report that highlights risks relevant to each stakeholder group.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of an Information Security Management System (ISMS)?

   • ATo ensure that all security incidents are prevented from occurring.
   • BTo replace all technical security controls with organizational policies.
   • CTo systematically manage and protect an organization's information assets through policies, processes, and controls.
   • DTo provide a one-time security assessment that identifies all vulnerabilities in an organization.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A regulatory auditor asks for evidence that the organization's data encryption controls are effective. Which security testing result would provide the most compelling evidence?

   • AA configuration review confirming that encryption is enabled.
   • BA statement from the IT manager that encryption is working.
   • CA vulnerability scan showing no known encryption vulnerabilities.
   • DA penetration test report showing that encrypted data could not be read without the decryption key.
   Reveal Solution Discussion Select an answer first