ISO-IEC-27001-LEAD-AUDITOR · Question #205
Scenario 1: Fintive is a distinguished security provider for online payments and protection solutions. Founded in 1999 by Thomas Fin in San Jose, California, Fintive offers services to companies…
The correct answer is B. Loss of reputation. Sending random files to users when receiving invalid inputs reflects unpredictable, uncontrolled system behavior - and for a company like Fintive whose core business is security and trust, this signals to customers that the company cannot even manage its own software safely…
Question
Scenario 1: Fintive is a distinguished security provider for online payments and protection solutions. Founded in 1999 by Thomas Fin in San Jose, California, Fintive offers services to companies that operate online and want to improve their information security, prevent fraud, and protect user information such as PII. Fintive centers its decision-making and operating process based on previous cases. They gather customer data, classify them depending on the case, and analyze them. The company needed a large number of employees to be able to conduct such complex analyses. After some years, however, the technology that assists in conducting such analyses advanced as well. Now, Fintive is planning on using a modern tool, a chatbot, to achieve pattern analyses toward preventing fraud in real-time. This tool would also be used to assist in improving customer service. This initial idea was communicated to the software development team, who supported it and were assigned to work on this project. They began integrating the chatbot on their existing system. In addition, the team set an objective regarding the chatbot which was to answer 85% of all chat queries. After the successful integration of the chatbot, the company immediately released it to their customers for use. The chatbot, however, appeared to have some issues. Due to insufficient testing and lack of samples provided to the chatbot during the training phase, in which it was supposed "to learn" the queries pattern, the chatbot failed to address user queries and provide the right answers. Furthermore, the chatbot sent random files to users when it received invalid inputs such as odd patterns of dots and special characters. Therefore, the chatbot was unable to properly answer customer queries and the traditional customer support was overwhelmed with chat queries and thus was unable to help customers with their requests. Consequently, Fintive established a software development policy. This policy specified that whether the software is developed in-house or outsourced, it will undergo a black box testing prior to its implementation on operational systems. According to scenario 1, the chatbot sent random files to users when it received invalid inputs. What impact might that lead to?
Options
- AInability to provide service
- BLoss of reputation
- CLeak of confidential information
How the community answered
(43 responses)- A9% (4)
- B72% (31)
- C19% (8)
Explanation
Sending random files to users when receiving invalid inputs reflects unpredictable, uncontrolled system behavior - and for a company like Fintive whose core business is security and trust, this signals to customers that the company cannot even manage its own software safely. This erodes customer confidence and public trust, making loss of reputation the primary impact.
Why A is wrong: Inability to provide service describes what happened due to the chatbot's failure to answer queries - a separate issue. The specific action of sending random files doesn't stop service delivery; it makes the service dangerous and untrustworthy.
Why C is wrong: The scenario says the chatbot sent random files, not confirmed confidential or sensitive ones. A leak of confidential information requires evidence that the files contained PII or protected data - the scenario doesn't establish this, so you cannot assume it.
Memory tip: Match the impact to the audience's perception. Random files = erratic behavior visible to customers = reputation damage. Confirmed sensitive data exposed = confidential leak. Service going down entirely = inability to provide service. Ask yourself: "Who is hurt, and how?"
Topics
Community Discussion
No community discussion yet for this question.