Analyzing and Documenting Security Testing Needs CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization is migrating a legacy on-premises application to a public cloud. The security team must identify the security testing needs for the new environment. What is the first step in this analysis?

   • APerform a risk assessment to identify new threats and compliance requirements introduced by the cloud environment.
   • BConduct penetration testing on the cloud infrastructure immediately.
   • CCompare the cloud provider's security features with the on-premises security controls.
   • DReview the application's source code for vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security tester is documenting the security testing needs for a mobile banking app. The documentation must be useful for both the development team and the compliance officer. What should the documentation include?

   • AA detailed description of each testing technique to be used.
   • BA traceability matrix linking security requirements to specific test cases and compliance standards.
   • CA summary of the testing tools available in the organization.
   • DA list of all potential vulnerabilities found in similar apps.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security tester is analyzing the security testing needs for a web application that processes payment card data. Which input is MOST important to consider when determining the scope and depth of security testing?

   • AThe choice of cloud provider
   • BThe applicable regulatory and compliance requirements
   • CThe programming language used to develop the application
   • DThe number of developers on the team
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security tester is analyzing the security testing needs for a new API that will be exposed to third-party partners. The API will handle sensitive data. What is the most important consideration when defining the testing needs?

   • AThe API's response time and performance under load.
   • BThe number of developers working on the API.
   • CThe programming language used to develop the API.
   • DThe authentication and authorization mechanisms and the data protection requirements.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is developing a new internal HR system that will store employee personal data. The security team is asked to identify the security testing needs. Which approach is most appropriate?

   • ATest the system's backup and recovery procedures only.
   • BReview the system's user access logs for suspicious activity.
   • CFocus on testing the system's user interface for usability issues.
   • DConduct a data protection impact assessment (DPIA) and identify the associated security controls to test.
   Reveal Solution Discussion Select an answer first