Security Testing CT-GT Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   An online casino wants to assess its external attack surface before a regulatory inspection. The security team plans to identify open ports and services on its public-facing servers. Which type of network security testing is most appropriate for this initial assessment?

   • APenetration testing
   • BNetwork discovery and port scanning
   • CVulnerability scanning
   • DSocial engineering testing
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is planning a penetration test of a gambling operator's network. The operator has strict change-management policies and requires that any testing activity be approved in advance. The team wants to minimize the risk of disrupting production services while still identifying exploitable vulnerabilities. Which approach best balances these concerns?

   • AConduct the penetration test in a cloned production environment.
   • BUse only automated vulnerability scanning to avoid any manual exploitation.
   • CPerform the penetration test during a scheduled maintenance window with a rollback plan.
   • DRun the penetration test without prior notification to obtain realistic results.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a security test, the testing team has identified several vulnerabilities in a gambling system. The project manager wants to ensure that the most critical issues are addressed first. What should the team do as part of the reporting and remediation step?

   • ARe-run the security test to confirm the vulnerabilities still exist.
   • BReport the vulnerabilities to the regulator and wait for instructions.
   • CPrioritize vulnerabilities based on risk and impact, and create a remediation plan with assigned owners and deadlines.
   • DImmediately fix all vulnerabilities in the order they were discovered.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary function of a web application security scanner?

   • ATo manage user access permissions
   • BTo encrypt data in transit
   • CTo monitor network bandwidth usage
   • DTo test web applications for vulnerabilities such as cross-site scripting and SQL injection
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A gambling operator is preparing for a regulatory audit that requires evidence of a robust security testing program. The operator has been performing ad-hoc security tests but has not documented the process or tracked remediation. The compliance team needs to demonstrate a structured approach. What is the most effective way to address this gap?

   • AImplement a formal security testing process with documented procedures, regular testing, and a vulnerability tracking system.
   • BRetroactively document past ad-hoc tests to create a record of testing activity.
   • CPurchase a vulnerability management tool and run it once before the audit.
   • DHire an external firm to conduct a single comprehensive test and provide a report.
   Reveal Solution Discussion Select an answer first