Discuss ISC2 CISSP Exam Topic 5 Question 54

In setting expectations when reviewing the results of a security test, which of the following statements is MOST important to convey to reviewers?

AThe target's security posture cannot be further compromised.

BThe results of the tests represent a point-in-time assessment of the target(s).

CThe accuracy of testing results can be greatly improved if the target(s) are properly hardened.

DThe deficiencies identified can be corrected immediately

Suggested Answer: C

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Edison 11 months ago

D seems too optimistic; not all deficiencies can be fixed right away!

Ahmad 11 months ago

C is interesting, but not sure if hardening always leads to better results.

Jade 12 months ago

Wait, can we really say the security can't be compromised? Sounds risky.

Desmond 12 months ago

I agree, B is crucial for setting realistic expectations.

Danica 12 months ago

Definitely B, it's all about that point-in-time snapshot.

Phuong 1 year ago

I think option D is a bit too optimistic. Not all deficiencies can be fixed immediately, right? I remember seeing a similar question in our review materials.

Marget 1 year ago

I recall discussing how the accuracy of results can change based on the target's hardening, so option C could be relevant too.

Paulene 1 year ago

I'm not entirely sure, but I feel like option A might be misleading. Just because we say the security posture can't be compromised doesn't mean it's true.

Lashunda 1 year ago

I think option B is really important because it emphasizes that the results are just a snapshot in time. I remember practicing a question like this.

Tien 1 year ago

Okay, I've got this. The best way to mitigate the risk of malware in firmware updates is to ensure that only trusted administrators can install the updates, so I'm going with option C.

Donte 1 year ago

Ah yes, network slicing - this is the kind of question I was hoping to see. I've got a good handle on the core principles, so I'm feeling confident about this one.

Vicki 1 year ago

Octopus Deploy is a deployment automation tool, so I don't think that's the right answer here. We're looking for a tool that can analyze dependencies and identify security issues, not just deploy the application.

Lanie 1 year ago

Wait, I'm a little confused. Does the report need to be both financial and non-financial, or just complete and relevant? I'll have to re-read the question carefully before answering.

ISC2 CISSP Exam - Topic 5 Question 54 Discussion