Evaluating Security Testing Practices for Improvements CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services company conducts penetration tests twice a year against its public web application. After each test, the security team fixes the reported vulnerabilities and closes the findings. However, the same classes of vulnerabilities (e.g., SQL injection, XSS) reappear in new features between tests. The team wants to improve the effectiveness of its security testing practice. Which improvement should the team prioritize?

   • AExpand the scope of the penetration test to include internal network segments.
   • BIncrease the frequency of penetration tests from twice a year to quarterly.
   • CIntegrate automated security scanning and secure-coding training into the development lifecycle.
   • DReplace the external penetration testing vendor with a different firm.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has a security testing program that includes SAST, DAST, and penetration testing. The team is seeing a high number of false positives from their SAST tool, which is consuming significant time to triage. This is leading to 'alert fatigue' and the team is starting to ignore the tool's output. The team wants to improve the effectiveness of their testing practice. What is the most effective improvement to address this issue?

   • ATune the SAST tool's rules and configurations to reduce false positives, and establish a triage process for the remaining findings.
   • BDisable the SAST tool and rely solely on DAST and penetration testing.
   • CAssign a junior team member to manually review all SAST findings.
   • DIncrease the frequency of SAST scans to ensure no vulnerability is missed.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's security team wants to implement a structured methodology to improve its security testing practices. They have a mature testing program but want to ensure it aligns with industry best practices. Which of the following is the most appropriate first step in applying a structured improvement methodology?

   • AIncrease the security testing budget by 20%.
   • BConduct a gap analysis of the current testing practices against a recognized standard like OWASP or BSIMM.
   • CPurchase the latest security testing tools on the market.
   • DHire a new security testing manager to oversee the process.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's security team performs a penetration test once a year. The test is comprehensive and finds many vulnerabilities. However, the team notices that many of the vulnerabilities found in the test are in code that was written after the last test. The team wants to evaluate the effectiveness of their security testing practice. What is the primary weakness in this practice?

   • AThe penetration test is not thorough enough.
   • BThe penetration testers are not skilled enough.
   • CThe testing is not frequent enough to catch vulnerabilities introduced during the year.
   • DThe company is not using the right penetration testing tools.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of applying a structured improvement methodology to security testing practices?

   • ATo systematically plan, implement, and evaluate changes to improve the testing process
   • BTo immediately replace all testers with automated tools
   • CTo increase the number of security certifications held by the team
   • DTo document that no improvements are needed
   Reveal Solution Discussion Select an answer first