SSCP: Systems Security Certified PractitionerDemo

By ISC · Question Mode

QuestionQ761

Security Concepts and Practices

Which of the following is not a valid reason to use external penetration-testing service firms instead of corporate resources?

  • A They are more cost-effective
  • B They offer a lack of corporate bias
  • C They use highly talented ex-hackers
  • D They ensure a more complete reporting
Explanation

External penetration-testing firms can offer independence, cost advantages from specialized tools and expertise, and more complete reporting because internal employees may be influenced by prior security decisions or reluctant to report weaknesses fully. Hiring highly talented former hackers is not inherently a valid benefit: testing providers must meet integrity and trustworthiness requirements, and a criminal-hacking background can create unacceptable risk.

Community Discussion

No comments yet. Be the first to start the discussion!