Analyzing and Documenting Security Testing Needs CT-SEC Practice Questions (Page 4)

Questions 16–19

1. 16expert · hard

   A security tester is documenting the security testing needs for a system that will be used by multiple departments with different security requirements. The documentation must be clear and actionable for each department. What is the best way to achieve this?

   • AAsk each department to document its own needs independently.
   • BCreate a single generic document that applies to all departments.
   • CDocument only the most stringent requirements to ensure compliance.
   • DCreate a master document with sections tailored to each department's requirements.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which element is ESSENTIAL for making security testing needs documentation traceable?

   • AThe names of the testers
   • BA detailed description of the testing tools
   • CThe estimated cost of testing
   • DA unique identifier for each documented need
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is deploying a new customer-facing web application that will process credit card payments. The security team is asked to identify the security testing needs for this system. Which approach best aligns with the context and risk profile?

   • AAsk the development team to list all features and test each one for security issues.
   • BReview the application's user manual to identify security features that need testing.
   • CRun a vulnerability scanner against the production environment to identify known vulnerabilities.
   • DConduct a threat modeling session and review the payment card industry data security standard (PCI DSS) requirements to define testing scope.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security tester is documenting the security testing needs for a web application. The documentation will be used to plan the testing effort. Which information is essential to include?

   • AThe personal preferences of the project manager.
   • BThe specific security requirements and the associated test objectives.
   • CThe names of the developers who wrote the code.
   • DThe history of previous security incidents in the organization.
   Reveal Solution Discussion Select an answer first