CASE Professional Ethics & Standards 3 — Questions and Answers
Question 1: A CASE professional working as a consultant is offered a lucrative side contract by a competitor of their current client. What is the MOST ethical response?
- Accept the contract and keep it confidential
- Decline immediately without any disclosure
- Disclose the offer to the current client and seek guidance (Correct answer)
- Accept only if the work does not overlap technically
Correct answer: Disclose the offer to the current client and seek guidance
Disclosing potential conflicts of interest to the current client is required to maintain trust and ethical standing.
Question 2: Which of the following BEST describes 'responsible disclosure' in application security ethics?
- Immediately publishing all vulnerability details publicly
- Notifying the vendor privately and allowing reasonable time to patch before public disclosure (Correct answer)
- Reporting vulnerabilities only to government agencies
- Disclosing only vulnerabilities that are already being actively exploited
Correct answer: Notifying the vendor privately and allowing reasonable time to patch before public disclosure
Responsible disclosure involves notifying the affected vendor first and giving them time to remediate before going public.
Question 3: A security engineer is approached by law enforcement requesting access to an application's user data without a warrant. The MOST appropriate action is to:
- Provide the data immediately to cooperate with authorities
- Refuse all cooperation regardless of circumstances
- Require a valid legal order before providing any data (Correct answer)
- Notify users that law enforcement is requesting their data
Correct answer: Require a valid legal order before providing any data
Legal process such as a court order or warrant must be established before disclosing user data to law enforcement.
Question 4: Continuing professional education (CPE) requirements for security certifications primarily serve to ensure that professionals:
- Pay their certification renewal fees on time
- Maintain current knowledge in a rapidly evolving field (Correct answer)
- Build professional networks within the industry
- Demonstrate loyalty to the certifying body
Correct answer: Maintain current knowledge in a rapidly evolving field
CPE requirements exist to keep certified professionals current with evolving threats, technologies, and best practices.
Question 5: A security professional is asked to sign off on a security assessment they did not personally perform. The MOST ethical course of action is to:
- Sign off if they trust the person who did perform it
- Refuse to sign off on work they cannot personally verify (Correct answer)
- Review a summary of findings before signing
- Sign off only if their name is not publicly associated with the report
Correct answer: Refuse to sign off on work they cannot personally verify
Certifying work you did not perform or cannot verify is a misrepresentation and violates professional ethics.
Question 6: In the context of application security, 'security theater' refers to measures that:
- Use deception techniques to catch attackers
- Provide strong visible security controls with minimal overhead
- Create the appearance of security without meaningfully reducing risk (Correct answer)
- Simulate attack scenarios for training purposes
Correct answer: Create the appearance of security without meaningfully reducing risk
Security theater involves security measures that look effective but do not substantively reduce actual risk.
Question 7: A CASE practitioner realizes mid-project that the scope of required security work exceeds their competence in one specific area. The MOST ethical action is to:
- Complete the work anyway and disclose any gaps in the final report
- Subcontract that portion to a qualified expert and inform the client (Correct answer)
- Expand their scope of the project to hide the gap
- Do nothing and hope the client does not notice
Correct answer: Subcontract that portion to a qualified expert and inform the client
Recognizing and disclosing competence limits, then bringing in qualified assistance, upholds professional ethics and protects the client.
CASE Professional Ethics & Standards 3
A CASE professional working as a consultant is offered a lucrative side contract by a competitor of their current client.
What is the MOST ethical response?