Input for an Information Security Management System (ISMS) CT-STE Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A security test identifies a vulnerability in a legacy system that cannot be patched immediately. The risk owner must decide how to treat this risk. Which input from the security test is most critical for this decision?

   • AA detailed assessment of the likelihood and impact of exploitation.
   • BThe CVSS score of the vulnerability.
   • CThe name of the vendor that developed the system.
   • DThe exact exploit code used in the test.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is it important to communicate security testing results to relevant stakeholders?

   • ATo replace the need for formal security reports.
   • BTo satisfy the requirement that all findings be made public.
   • CTo ensure that all stakeholders can perform security testing themselves.
   • DTo support informed decision-making and risk management.
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A security test simulates a data breach and successfully exfiltrates data from a test environment. The test team discovers that the data loss prevention (DLP) system did not alert. The organization has a legal obligation to report data breaches within 72 hours. What is the most appropriate immediate action?

   • ADisable the DLP system until it can be reconfigured.
   • BIgnore the finding because it was only a test.
   • CInvestigate why the DLP system failed and implement corrective actions.
   • DReport the test as a data breach to the regulatory authority.
   Reveal Solution Discussion Select an answer first