Evaluating a Tool Vendor's Capabilities CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a key step in planning a trial or proof of concept for a security testing tool?

   • ASkipping the trial to save time
   • BSelecting a tool based on the vendor's marketing claims
   • CDefining success criteria that align with the organization's requirements
   • DChoosing a tool based on its price alone
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a sign of a vendor's innovation history?

   • AA track record of releasing new features and improvements
   • BA long history of the company being in business
   • CA high number of employees
   • DA large marketing budget
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When evaluating a security testing tool's scalability, what is the primary question to answer?

   • ACan the tool handle the organization's expected workload as it grows?
   • BIs the tool compatible with the organization's operating systems?
   • CDoes the tool provide good documentation?
   • DDoes the tool have a user-friendly interface?
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is evaluating a new DAST tool. The tool must integrate with their existing CI/CD pipeline, which uses Jenkins, and must also feed results into their SIEM. The vendor provides a Jenkins plugin, but the SIEM integration requires a custom script. The team has limited development resources. During the proof of concept, what should the team prioritize?

   • AFocus only on the Jenkins plugin, because the SIEM integration can be done later.
   • BSelect a different tool that has native SIEM integration, even if it lacks a Jenkins plugin.
   • CTest the Jenkins plugin to ensure it works in the pipeline, and evaluate the effort required to build the custom SIEM script.
   • DAsk the vendor to build the SIEM integration for free as part of the contract.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is selecting a penetration testing tool vendor. The team is concerned about the vendor's long-term viability because the vendor is a startup. The vendor's product roadmap includes a planned API for custom integrations, which the team needs. What should the team do to assess the vendor's long-term viability?

   • AAsk the vendor for a discount in exchange for a longer contract, which will ensure support.
   • BAssume the vendor will be acquired by a larger company, ensuring continuity.
   • CReview the vendor's funding history, customer growth, and product roadmap milestones to gauge financial stability and commitment to the roadmap.
   • DFocus only on the current feature set, ignoring the roadmap because it may change.
   Reveal Solution Discussion Select an answer first