Analyzing Interim Security Test Status Reports CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security test team is conducting a penetration test on a healthcare application. The interim status report reveals a critical vulnerability in the patient data export function that could allow unauthorized access to protected health information. The initial risk assessment for the system was rated as 'medium' based on the threat model. How should the test lead update the risk assessment?

   • AKeep the risk assessment at 'medium' because the vulnerability has not been exploited in production.
   • BLeave the risk assessment unchanged but add a note that a critical vulnerability was found.
   • CIncrease the risk assessment to 'high' because the critical vulnerability increases the likelihood and impact of a breach.
   • DDecrease the risk assessment to 'low' because the vulnerability was found during testing and can be fixed before go-live.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When communicating interim security test status to senior management, what is the most appropriate level of detail?

   • AA technical explanation of every vulnerability's exploit mechanism
   • BA high-level summary of progress, key risks, and major findings
   • CA detailed list of every test case and its result
   • DThe complete source code of the system under test
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security test lead must present interim findings to a mixed audience of executives, developers, and compliance officers. The report includes a critical vulnerability in a customer database. The compliance officer needs to know if the vulnerability violates any regulations. The developers need technical details to fix it. The executives need to understand the business impact. What is the most effective communication strategy?

   • APresent the full technical report to everyone to ensure transparency and avoid missing details.
   • BPresent a single report with a high-level summary for executives, a technical section for developers, and a compliance impact section for the compliance officer.
   • CPresent the report only to the executives and let them decide what to share with others.
   • DPresent only the summary to everyone and defer technical details to a separate meeting with developers.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An interim security test report shows that 80% of test cases have been executed, but only 50% of the planned test cases have passed. The test plan expected a 90% pass rate at this stage. The team lead must assess the current state of testing. What is the most appropriate conclusion?

   • AThe testing is progressing well because 80% execution is high, and the pass rate will improve as more tests are run.
   • BThe testing is off track because the pass rate is low, and the team should immediately re-test all failed cases.
   • CThe testing is behind schedule because the pass rate is lower than expected, and the team should stop testing to investigate.
   • DThe testing is on track for execution, but the low pass rate suggests a higher number of defects than anticipated, which may impact the schedule.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which audience would most likely require a detailed technical breakdown of security findings in an interim status report?

   • AMarketing department
   • BSenior management
   • CThe development team responsible for fixing the issues
   • DExternal auditors
   Reveal Solution Discussion Select an answer first