Evaluating Security Testing Practices for Improvements CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software company's security team performs a manual code review before each release. The reviews are thorough but take an average of 10 days, causing release delays. The team has a backlog of 50 identified issues, but 80% are low-severity style or linting problems. The team wants to improve the efficiency of its security testing practice without sacrificing security. What should the team do?

   • AImplement automated static analysis to catch low-severity issues, and reserve manual review for high-risk changes.
   • BPrioritize the backlog by fixing only the high-severity issues and ignoring the rest.
   • CIncrease the number of security reviewers on the team to reduce the review backlog.
   • DEliminate the manual code review process and rely solely on automated tools.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company wants to implement a structured methodology to improve its security testing practices. The team is currently using a checklist of common vulnerabilities. They want to move to a more comprehensive and risk-based approach. Which methodology is most appropriate for this goal?

   • AIncrease the number of items on the current checklist to ensure broader coverage.
   • BImplement a continuous integration pipeline that runs all security tools automatically.
   • CUse the MITRE ATT&CK framework to map all possible attack techniques.
   • DAdopt the OWASP Risk Rating Methodology to prioritize testing based on business impact.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's security team has a mature testing program with SAST, DAST, and penetration testing. They have a low false-positive rate and high coverage. However, they are seeing an increase in security incidents related to business logic flaws (e.g., privilege escalation, broken access control) that are not being caught by their automated tools. The team wants to improve their testing practice to address this gap. What is the most effective improvement?

   • AIncorporate threat modeling and manual testing focused on business logic into the development lifecycle.
   • BIncrease the frequency of automated DAST scans to run on every code commit.
   • CReplace the current SAST tool with a more advanced one that claims to detect business logic flaws.
   • DIncrease the scope of penetration testing to include all internal applications.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which activity is most directly associated with identifying improvement opportunities in security testing?

   • AExecuting a regression test suite
   • BConducting a gap analysis of current testing practices against desired outcomes
   • CDeploying a new firewall rule
   • DUpdating the organization's incident response plan
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's security team conducts regular penetration tests and vulnerability scans. They have a dashboard that tracks the number of open vulnerabilities by severity. The team wants to evaluate the effectiveness of their security testing practice. Which of the following metrics would provide the most insight into the effectiveness of the testing process itself?

   • AThe time taken to complete a full penetration test.
   • BThe number of vulnerabilities found per test.
   • CThe percentage of known vulnerabilities that are detected by the testing process.
   • DThe number of security testers on the team.
   Reveal Solution Discussion Select an answer first