Security Testing and Availability Testing CT-FT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which metric is commonly used to express the availability of a financial system?

   • APercentage of uptime per year
   • BNumber of security vulnerabilities found
   • CAverage response time
   • DNumber of transactions processed per second
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of security testing in a financial application?

   • ATo verify that the application meets functional requirements
   • BTo identify vulnerabilities and ensure the protection of data and resources
   • CTo measure the performance of the application under expected load
   • DTo ensure the application is free from all possible vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial institution is introducing a new online trading platform. The compliance officer insists that security testing must be a formal part of the software development lifecycle, not an afterthought. Which approach best aligns with this requirement?

   • ARely on the development team to perform informal security reviews during coding.
   • BIncorporate security testing activities into each phase of the development lifecycle, from requirements to maintenance.
   • CConduct a single comprehensive security test just before the production release.
   • DOutsource all security testing to an external vendor after each release.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial software development team is adopting a DevSecOps approach. They want to identify security vulnerabilities as early as possible in the development lifecycle, ideally before code is merged into the main branch. Which security testing technique should they integrate into their continuous integration pipeline?

   • AVulnerability scanning of the production network infrastructure.
   • BDynamic application security testing (DAST) against a staging environment after deployment.
   • CPenetration testing performed by an external team on the production environment.
   • DStatic application security testing (SAST) as part of the build process.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A financial institution is defining availability requirements for a new mobile banking app. The business wants the app to be available 99.9% of the time, but the testing team is concerned that this metric is not meaningful without additional context. Which additional requirement should be defined to make the availability metric more actionable?

   • AThe number of security vulnerabilities that must be fixed before release.
   • BThe budget allocated for availability testing.
   • CThe recovery time objective (RTO) and recovery point objective (RPO) for the app.
   • DThe maximum number of concurrent users the app must support.
   Reveal Solution Discussion Select an answer first