CASE Communication & Stakeholder Engagement 3

Question 1

Which metric is most meaningful when reporting application security program effectiveness to a CISO?

Accepted Answer

Mean time to remediate critical vulnerabilities

Answer

Mean time to remediate directly measures the program's ability to reduce risk exposure over time.

Question 2

A development team is resistant to security training. Which approach is most likely to improve engagement?

Accepted Answer

Embed security scenarios relevant to their specific tech stack and real past incidents

Answer

Contextual, role-relevant training increases engagement by making security directly applicable to developers' daily work.

Question 3

When writing a security exception request, what information is essential to include?

Accepted Answer

Risk description, compensating controls, business justification, and expiration date

Answer

A complete exception request documents the risk, how it is mitigated, why it is accepted, and when it must be reviewed.

Question 4

How should security findings be prioritized when communicating with a development team backlog?

Accepted Answer

By exploitability, business impact, and ease of remediation

Answer

Combining exploitability, business impact, and remediation cost helps teams fix the highest-value issues first.

Question 5

A stakeholder asks why security testing cannot be completed overnight before a major release. What is the best response?

Accepted Answer

Explain that thorough security testing requires time to explore logic flaws that automated tools miss

Answer

Manual and logic-based security testing cannot be arbitrarily compressed without missing significant vulnerability classes.

(CASE) Certified Application Security Engineer Practice Test