CASE Communication & Stakeholder Engagement 2

Question 1

A security engineer needs to present a vulnerability report to the board of directors. Which approach is most effective?

Accepted Answer

Translate technical risks into business impact and financial exposure

Answer

Board members respond to business risk and financial impact, not technical jargon or CVE identifiers.

Question 2

During a security architecture review, a developer insists their custom encryption implementation is secure. What is the best response?

Accepted Answer

Reference established cryptographic standards and explain the risks of custom implementations

Answer

Citing authoritative standards (NIST, OWASP) provides objective grounds for the discussion without making it personal.

Question 3

A product manager requests that a security control be removed to accelerate a release. How should the security engineer respond?

Accepted Answer

Document the risk formally and request a signed risk acceptance

Answer

Formal risk acceptance transfers accountability to the appropriate business owner and creates an audit trail.

Question 4

Which communication technique best helps a security team gain stakeholder buy-in for a new security policy?

Accepted Answer

Show how the policy aligns with business goals and reduces liability

Answer

Aligning security initiatives with business objectives demonstrates value and encourages voluntary adoption.

Question 5

A third-party vendor claims their application is 'fully secure.' What should the security engineer do?

Accepted Answer

Request independent security assessment evidence or a penetration test report

Answer

Security claims without evidence are unverifiable; requesting independent assessments establishes objective assurance.

(CASE) Certified Application Security Engineer Practice Test