CASE Professional Ethics & Standards 2

Question 1

A security engineer discovers a zero-day vulnerability in a client's production system during a penetration test. The client's contract specifies findings must be reported within 30 days. What is the MOST ethical course of action?

Accepted Answer

Report the vulnerability to the client immediately due to its severity

Answer

Critical vulnerabilities should be reported immediately to the client regardless of contract timelines to prevent potential harm.

Question 2

Under the ISC2 Code of Ethics, which canon takes the HIGHEST priority when canons conflict?

Accepted Answer

Protect society, the common good, necessary public trust and confidence

Answer

ISC2's Code of Ethics lists protecting society as the first and highest-priority canon.

Question 3

A CASE professional is asked by their employer to implement a security control they believe violates user privacy rights. After raising concerns internally with no resolution, the MOST appropriate next step is to:

Accepted Answer

Escalate through appropriate channels such as legal counsel or a regulatory body

Answer

When internal escalation fails, professionals should use legitimate channels such as legal or regulatory bodies rather than public disclosure or silent compliance.

Question 4

Which principle is MOST directly violated when a security professional accepts gifts from a vendor whose product they are evaluating for their organization?

Accepted Answer

Conflict of interest avoidance

Answer

Accepting gifts from a vendor being evaluated creates a conflict of interest that compromises objectivity.

Question 5

An application security engineer identifies that a colleague is deliberately injecting vulnerabilities into code to appear more valuable during remediation. This behavior MOST directly violates which ethical principle?

Accepted Answer

Act honorably and honestly

Answer

Deliberately creating vulnerabilities for personal gain is a fundamentally dishonest and unethical act.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Professional Ethics & Standards 2