CT-SEC: Certified Tester Security Tester

By ISTQB · Question Mode

QuestionQ12

Security Testing Processes

An organization has established a security policy to protect its digital and physical assets. The policy also provides for offsite tape storage and cloud backup. Security-testing objectives do not include offsite storage.

Which ONE of the following arguments about this situation is VALID?

Explanation

Security-testing coverage may be tailored according to asset classification and risk. Excluding offsite tape storage can therefore be valid when the stored assets are formally classified as non-sensitive; neither obscurity, presumed low importance, nor physical security alone justifies excluding a storage location from security testing.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!