Exam CISM topic 1 question 927 discussion

As a pentester I can tell you that B is definitely very concerning. But almost equally concerning should be C. In the context of this question maybe not so much, but in general this can be a big deal.

Why not D? If public vulnrabilities were not found by internal testing than the process is very faulty and the problem will certainly occure again.

The greatest concern among the given options would be option B: Exploit code for one of the vulnerabilities is publicly available. This is a significant concern because if the exploit code is publicly available, it means that it can be easily accessed and utilized by threat actors with malicious intent. This increases the likelihood of a successful attack on the organization's web application, potentially leading to unauthorized access, data breaches, or other types of security incidents. It is essential to address this vulnerability urgently and take appropriate actions to mitigate the risk.

um....i vote B. Exploit code for one of the vulnerabilities is publicly available.

C. Atules of engagement form was not signed prior to the penetration test. , I am not sure of this but think if the Rules of engagement was not signed and that means any loss caused by them cant be legal plus they can look into confidential stuff

If the exploit code is available publicly (making it a known vulnerability to all including the organization) then a suitable control can be selected and implemented. However, if user acceptance is the main issue, after the application is in production, then the challenge could be major, pointing toward design flaws, rejection of technology etc. Or, at least, I think so. Appreciate more views on this.