Exam CISSP topic 1 question 174 discussion

For exam, A. For real work environment, D. Your boss ask you to do it, do it please

According to the (ISC) Code of Professional Ethics, CISSP professionals are obligated to provide services only in areas where they are competent and qualified. If a CISSP has never performed a vulnerability assessment on a web application and is unsure of their capabilities, the ethical course of action is to inform the CISO that they are unable to perform the task and may need to seek assistance or additional training. Option A aligns with the principle of integrity and responsibility outlined in the (ISC) Code of Professional Ethics. It emphasizes the importance of honesty and competence in providing services. Seeking assistance or training in areas where competence is lacking is a responsible and ethical approach.

The CISSP cannot perform a vulnerability assessment on a web application to pass a Payment Card Industry (PCI) audit if they are not fully competent and qualified because it goes against the (ISC) Code of Professional Ethics. The code requires that a CISSP should render only those services for which they are fully competent and qualified. Performing a task that the CISSP is not fully competent and qualified to do can result in inadequate or incorrect assessment and recommendations, which can lead to security vulnerabilities and non-compliance with regulations such as PCI DSS. It is essential to ensure that the person performing the vulnerability assessment has the necessary knowledge, skills, and experience to carry out a comprehensive and accurate assessment.

Separation of Duties plus act honestly !

Not sure why the answer would be A, anyone that has worked with PCI-DSS knows its a self regulated standard. There is no accreditation on the part of the assessor https://www.pcidssguide.com/how-to-successfully-pass-a-pci-compliance-scan/

A, no experience should not take the task

First step would be to investigate whether they are actually not qualified and competent if you ask me. With A you are already assuming this. D for me.

A is right, it is a canon of ISC2