Analyzing Interim Security Test Status Reports CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An interim security test status report shows that only 60% of planned test cases have been executed, but the plan expected 80% by this date. What does this indicate?

   • ATesting is ahead of schedule
   • BThe system is more secure than expected
   • CThe test plan is invalid and should be discarded
   • DA deviation from the test plan that may require corrective action
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An interim security test report lists three findings: a critical SQL injection in a public-facing web application, a high-severity misconfiguration in an internal admin console, and a medium-severity information disclosure in a low-traffic API. The system is scheduled to go live in two weeks. How should the test lead prioritize follow-up actions?

   • AAddress all findings equally because all security issues must be fixed before go-live.
   • BPrioritize the SQL injection, then the admin console misconfiguration, and then the API information disclosure.
   • CPrioritize the admin console misconfiguration because it is internal and could lead to lateral movement.
   • DPrioritize the API information disclosure because it is the easiest to fix and can be resolved quickly.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security test lead is preparing an interim status report for a client. The client is a small business with limited technical expertise. The report must include a critical vulnerability that was found in the client's customer database. The client is concerned about the cost of remediation. What is the most appropriate way to present the finding?

   • APresent the finding and recommend immediate remediation without discussing cost, as security should be prioritized.
   • BPresent only the technical details and let the client's IT staff interpret the finding.
   • CPresent the finding with a clear explanation of the business impact and a recommended remediation plan, including estimated effort and cost.
   • DPresent the finding but downplay the severity to avoid alarming the client.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An interim security test report includes a finding that a low-severity vulnerability exists in a non-critical internal tool. The system under test is a public-facing e-commerce platform. The test lead must decide how to handle this finding in the report. What is the most appropriate action?

   • AInclude the finding in the report but mark it as low priority and note that it does not affect the overall risk assessment.
   • BExclude the finding from the report because it is not relevant to the e-commerce platform.
   • CInclude the finding and recommend immediate remediation because all findings must be fixed.
   • DInclude the finding but raise its severity to ensure it gets attention.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security test lead is preparing the interim status report for a client that is not highly technical. The report must communicate that a critical vulnerability was found in a customer-facing application. What is the most appropriate way to present this finding?

   • AInclude the full technical details in an appendix and refer to it in the summary.
   • BUse technical terms like 'SQL injection' and 'parameterized queries' to be precise.
   • CDescribe the finding in business terms, such as 'a vulnerability that could allow unauthorized access to customer data', and explain the potential impact.
   • DProvide only the severity rating and defer all details to the final report.
   Reveal Solution Discussion Select an answer first