Confidentiality of Security Test Results CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security testing team uses a shared document management system to store test results. The team wants to ensure that only the testers and the project manager can access the documents. Which of the following is the BEST way to achieve this?

   • ACreate a security group for the testers and project manager and assign permissions to that group.
   • BEncrypt the documents and share the password with the testers and project manager.
   • CAssign permissions to each individual user separately.
   • DStore the documents in a public folder and rely on the document management system's default settings.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security testing firm is about to start an engagement with a client. The contract includes a clause that specifies how test results must be handled. What should the firm do to ensure compliance with the contractual obligations?

   • AReview the contract and implement procedures that align with the confidentiality requirements.
   • BStore the results in a location that is not covered by the contract.
   • CIgnore the clause and follow the firm's standard procedures.
   • DAsk the client to remove the clause from the contract.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester has completed an assessment for a client and needs to send the final report. The client requires the report to be delivered electronically. Which of the following is the MOST secure method to transmit the report?

   • APrint the report and mail it via standard postal service without any additional protection.
   • BEncrypt the report file with a strong password and send it as an email attachment, then share the password via a separate communication channel.
   • CUpload the report to a public cloud storage service and share the link with the client.
   • DSend the report as a plain-text email attachment to the client's generic contact address.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which risk is most directly associated with unauthorized disclosure of security test results?

   • AInvalidation of the test methodology used
   • BIncreased likelihood of the system being exploited by attackers
   • CDecreased performance of the system under test
   • DLoss of the tester's certification credentials
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the recommended way to dispose of security test results that are no longer needed?

   • ALeave them in a public cloud storage folder
   • BMove them to the recycle bin and empty it
   • COverwrite the files with a simple rename
   • DSecurely delete digital files and shred physical documents
   Reveal Solution Discussion Select an answer first