CASE Communication & Stakeholder Engagement 2 — Questions and Answers
Question 1: A security engineer needs to present a vulnerability report to the board of directors. Which approach is most effective?
- Detail every CVE with CVSS scores
- Translate technical risks into business impact and financial exposure (Correct answer)
- Provide raw penetration test output
- Focus on patch timelines and version numbers
Correct answer: Translate technical risks into business impact and financial exposure
Board members respond to business risk and financial impact, not technical jargon or CVE identifiers.
Question 2: During a security architecture review, a developer insists their custom encryption implementation is secure. What is the best response?
- Accept their claim to avoid conflict
- Escalate immediately to the CISO
- Reference established cryptographic standards and explain the risks of custom implementations (Correct answer)
- Require a full code audit before proceeding
Correct answer: Reference established cryptographic standards and explain the risks of custom implementations
Citing authoritative standards (NIST, OWASP) provides objective grounds for the discussion without making it personal.
Question 3: A product manager requests that a security control be removed to accelerate a release. How should the security engineer respond?
- Remove the control as requested
- Immediately block the release
- Document the risk formally and request a signed risk acceptance (Correct answer)
- Notify regulators of the request
Correct answer: Document the risk formally and request a signed risk acceptance
Formal risk acceptance transfers accountability to the appropriate business owner and creates an audit trail.
Question 4: Which communication technique best helps a security team gain stakeholder buy-in for a new security policy?
- Mandate compliance through legal notices
- Show how the policy aligns with business goals and reduces liability (Correct answer)
- Send a detailed technical specification
- Enforce the policy before announcing it
Correct answer: Show how the policy aligns with business goals and reduces liability
Aligning security initiatives with business objectives demonstrates value and encourages voluntary adoption.
Question 5: A third-party vendor claims their application is 'fully secure.' What should the security engineer do?
- Trust the vendor's claim and proceed
- Request independent security assessment evidence or a penetration test report (Correct answer)
- Conduct a social engineering test on the vendor
- Block the vendor from the network immediately
Correct answer: Request independent security assessment evidence or a penetration test report
Security claims without evidence are unverifiable; requesting independent assessments establishes objective assurance.
Question 6: When communicating a zero-day vulnerability to internal stakeholders, what should be prioritized in the initial notification?
- Full technical exploitation details
- Severity, affected systems, and immediate containment actions (Correct answer)
- Vendor patch availability date
- Historical context of similar vulnerabilities
Correct answer: Severity, affected systems, and immediate containment actions
Initial notifications must enable fast decision-making by clearly stating impact and required immediate actions.
Question 7: A security engineer disagrees with a compliance officer's interpretation of a regulatory requirement. What is the appropriate next step?
- Override the compliance officer's decision
- Ignore the disagreement and implement your own interpretation
- Document both interpretations and escalate to legal counsel for a binding decision (Correct answer)
- Defer entirely to the compliance officer
Correct answer: Document both interpretations and escalate to legal counsel for a binding decision
Legal counsel provides authoritative interpretation of regulatory requirements when internal experts disagree.
CASE Communication & Stakeholder Engagement 2
A security engineer needs to present a vulnerability report to the board of directors.
Which approach is most effective?