CASE Communication & Stakeholder Engagement 3 — Questions and Answers
Question 1: Which metric is most meaningful when reporting application security program effectiveness to a CISO?
- Number of lines of code scanned
- Mean time to remediate critical vulnerabilities (Correct answer)
- Total number of SAST tool alerts generated
- Number of security engineers on the team
Correct answer: Mean time to remediate critical vulnerabilities
Mean time to remediate directly measures the program's ability to reduce risk exposure over time.
Question 2: A development team is resistant to security training. Which approach is most likely to improve engagement?
- Make training mandatory with disciplinary consequences
- Embed security scenarios relevant to their specific tech stack and real past incidents (Correct answer)
- Send weekly security newsletters
- Require security certifications for all developers
Correct answer: Embed security scenarios relevant to their specific tech stack and real past incidents
Contextual, role-relevant training increases engagement by making security directly applicable to developers' daily work.
Question 3: When writing a security exception request, what information is essential to include?
- The names of engineers who identified the issue
- Risk description, compensating controls, business justification, and expiration date (Correct answer)
- Full vulnerability scan output
- All prior security incidents in the system
Correct answer: Risk description, compensating controls, business justification, and expiration date
A complete exception request documents the risk, how it is mitigated, why it is accepted, and when it must be reviewed.
Question 4: How should security findings be prioritized when communicating with a development team backlog?
- By CVSS score alone
- Alphabetically by vulnerability type
- By exploitability, business impact, and ease of remediation (Correct answer)
- By the order tools discovered them
Correct answer: By exploitability, business impact, and ease of remediation
Combining exploitability, business impact, and remediation cost helps teams fix the highest-value issues first.
Question 5: A stakeholder asks why security testing cannot be completed overnight before a major release. What is the best response?
- Agree to compress testing into one night
- Explain that thorough security testing requires time to explore logic flaws that automated tools miss (Correct answer)
- Blame the development team for late delivery
- Suggest skipping testing for this release
Correct answer: Explain that thorough security testing requires time to explore logic flaws that automated tools miss
Manual and logic-based security testing cannot be arbitrarily compressed without missing significant vulnerability classes.
Question 6: What is the primary purpose of a Responsible Disclosure Policy when communicating with external security researchers?
- To prevent any public disclosure of vulnerabilities
- To establish clear reporting channels, response timelines, and disclosure rules (Correct answer)
- To grant researchers access to production systems
- To compensate researchers for any bugs found
Correct answer: To establish clear reporting channels, response timelines, and disclosure rules
A Responsible Disclosure Policy sets expectations for both parties, reducing legal ambiguity and enabling coordinated disclosure.
Question 7: Which stakeholder communication strategy best supports a shift-left security culture?
- Conduct security reviews only after code is merged
- Integrate security checkpoints into sprint planning and definition of done (Correct answer)
- Assign security reviews exclusively to the security team
- Run quarterly penetration tests as the primary assurance activity
Correct answer: Integrate security checkpoints into sprint planning and definition of done
Embedding security into sprint planning makes it part of the development workflow rather than a gate at the end.
CASE Communication & Stakeholder Engagement 3
Which metric is most meaningful when reporting application security program effectiveness to a CISO?