Câu 12: CT-SEC: Certified Tester Security Tester

An organization has a security policy in place for the protection of its digital and physical assets. The policy also includes offsite storage on tape and backup on cloud. The security testing objectives do not cover offsite storage. Which ONE of the following arguments regarding this situation is VALID?

1. A. Not covering off-site storage as a test objective may be a valid decision if the data stored on tapes is classified as non-sensitive digital and physical asset. — đáp án hiện tại
2. B. Not covering off-site storage as a test objective is a valid decision as off-site storage is typically secret and unknown to hackers.
3. C. Not covering off-site storage as a test objective is a valid decision because the data stored on tapes is generally low importance and hence can be treated out of scope.
4. D. Not covering off-site storage as a test objective is a valid decision because off-site storage is physically secured.