Evaluating a Tool Vendor's Capabilities CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to review a vendor's product roadmap when selecting a security testing tool?

   • ATo check the vendor's employee count
   • BTo verify the vendor's office location
   • CTo confirm the vendor's marketing strategy
   • DTo ensure the vendor's future plans align with the organization's long-term needs
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is evaluating two DAST vendors for a 3-year engagement. Vendor A has a strong market reputation and a large customer base, but its product roadmap is conservative, with no planned support for the team's upcoming GraphQL API testing needs. Vendor B is newer, with fewer customers, but its roadmap includes GraphQL testing in the next release. The team's primary requirement is to test GraphQL APIs within the next 12 months. Which vendor should the team select?

   • AVendor B, because it is newer and likely to be more innovative in other areas as well.
   • BVendor A, because the team can use a third-party plugin to add GraphQL testing.
   • CVendor A, because its market reputation and large customer base ensure long-term stability and support.
   • DVendor B, because the roadmap aligns with the team's future requirement for GraphQL testing, which is a critical need.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is evaluating a new RASP vendor. The vendor's support team is known for being responsive, but the contract's SLA only guarantees a 48-hour response time for critical issues. The team's security operations center operates 24/7 and expects a response within 4 hours for critical incidents. The vendor is the only one that meets all other technical requirements. What should the team do?

   • ASelect a different vendor that offers a 4-hour SLA, even if it does not meet all technical requirements.
   • BAccept the 48-hour SLA because the vendor is the only one that meets the technical requirements.
   • CRely on the vendor's reputation for responsiveness, assuming they will respond faster than the SLA.
   • DNegotiate a custom SLA that provides a 4-hour response for critical issues, given the vendor's proven responsiveness.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of conducting a proof of concept (PoC) for a security testing tool?

   • ATo evaluate the vendor's marketing materials
   • BTo negotiate a lower price with the vendor
   • CTo check the vendor's financial stability
   • DTo validate the vendor's claims in a real-world environment
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is evaluating two SAST vendors. Vendor A charges a flat annual fee based on the number of lines of code (LOC). Vendor B charges per developer per month. The company has 200 developers and a codebase of 5 million LOC, which is expected to grow by 20% annually. The security team expects to add 50 developers in the next year. Which vendor's licensing model is likely to be more cost-effective over the next three years?

   • AVendor B, because per-developer pricing is always more predictable than LOC-based pricing.
   • BVendor B, because per-developer pricing aligns with the number of users, which is a better indicator of usage.
   • CVendor A, because the LOC-based fee will increase with code growth, but the developer count will grow faster, making Vendor B more expensive.
   • DVendor A, because LOC-based pricing is always cheaper for large codebases.
   Reveal Solution Discussion Select an answer first