Which of the following is NOT a valid reason to use external penetration service firms rather than corporate resources?

The correct answer is C. They use highly talented ex-hackers. The question asks for what is NOT a legitimate justification. A (cost-effectiveness) is valid - external firms often cost less than maintaining an in-house red team. B (lack of corporate bias) is valid - outsiders approach systems without preconceptions about what 'should' be sec

Submitted by suresh_in· Apr 18, 2026Security Concepts and Practices

Question

Options

AThey are more cost-effective
BThey offer a lack of corporate bias
CThey use highly talented ex-hackers
DThey ensure a more complete reporting

How the community answered

(32 responses)

B
6% (2)
C
91% (29)
D
3% (1)

Explanation

The question asks for what is NOT a legitimate justification. A (cost-effectiveness) is valid - external firms often cost less than maintaining an in-house red team. B (lack of corporate bias) is valid - outsiders approach systems without preconceptions about what 'should' be secure. D (more complete reporting) is valid - professional firms deliver formal, structured deliverables. C is NOT a valid reason: the fact that a firm employs ex-hackers is not an inherent professional qualification or organizational benefit; it is an irrelevant or potentially concerning characteristic. Trustworthiness and methodology matter far more than a tester's background as a former attacker. Using this as a selection criterion could actually introduce risk.

Topics

#Penetration Testing#Third-Party Security Services#Security Assessment#Vendor Management

Community Discussion

No community discussion yet for this question.

Full SSCP Practice