CISSP Practice Question: In a financial institution with limited budget, which approach to security testing…

Correct Answer: C. Adopt a risk-based testing framework

Explanation (CISSP Manager Logic):

A risk-based approach aligns security testing with business objectives by prioritizing high-value assets and critical threats. This ensures that limited resources are allocated where they provide the greatest risk reduction and compliance coverage.

By adopting a risk-based framework, you:

• Maximize the ROI of a limited security budget.
• Focus testing efforts on the most significant business impacts.
• Ensure compliance requirements are met through documented risk prioritization.

While the other options are relevant, they fall short because:

• A: Comprehensive penetration testing is often too expensive and narrow in scope for a budget-constrained environment.
• B: Audits are typically point-in-time compliance checks that may miss emerging technical vulnerabilities.
• D: Training is a vital administrative control but does not provide a technical assessment of system security posture.

Think like a manager:

Security is a resource allocation problem. Always prioritize actions that address the highest risk to the organization's mission and bottom line.