Evaluating Security Testing Practices for Improvements CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has a security testing process that includes a weekly vulnerability scan and a monthly manual review of the findings. The team notices that the same medium-severity vulnerabilities are being reported every week, but they are not being fixed. The team wants to evaluate the effectiveness of their security testing practice. What is the primary weakness in this practice?

   • AThe vulnerability scanner is not configured to detect the specific vulnerabilities.
   • BThe scanning frequency is too low to detect new vulnerabilities.
   • CThe manual review is not thorough enough to identify the root cause of the vulnerabilities.
   • DThe practice lacks a defined remediation process to ensure findings are addressed.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of evaluating security testing practices against defined criteria?

   • ATo guarantee that no security vulnerabilities will ever be missed in the future
   • BTo replace all existing security testing tools with newer versions
   • CTo increase the number of security tests performed each month
   • DTo determine whether current practices meet the organization's security testing objectives and standards
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization's security testing program consists of uncoordinated ad-hoc vulnerability scans performed by different teams. The organization wants to implement a structured methodology to improve its security testing practices. Which approach best aligns with a structured improvement methodology?

   • ACreate a new team dedicated solely to writing security test cases.
   • BAdopt the OWASP Testing Guide to define a repeatable, comprehensive testing framework.
   • CPurchase a more expensive commercial vulnerability scanner.
   • DConsolidate all testing into a single annual penetration test.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's security team has a testing program that includes a monthly vulnerability scan and a quarterly penetration test. They want to evaluate the effectiveness of their program. They have a list of all known vulnerabilities in their environment, but they are unsure if their testing is finding them all. What is the best way to evaluate the effectiveness of their testing program?

   • ACheck the cost of the testing tools.
   • BReview the qualifications of the security testers.
   • CCompare the vulnerabilities found by their testing against the list of known vulnerabilities to calculate a detection rate.
   • DCount the total number of vulnerabilities found by their testing.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's security team has a testing program that is heavily focused on external-facing web applications. They have recently deployed a new internal application that handles employee PII. The team wants to improve their testing practice to cover this new asset. They have a limited budget and cannot afford a full penetration test for the internal application. What is the most effective improvement to address this gap?

   • APerform a vulnerability scan of the internal application using an authenticated scanner.
   • BReallocate the budget from the external web application testing to the internal application.
   • CDelay testing the internal application until the next budget cycle.
   • DAsk the internal application developers to perform a self-review.
   Reveal Solution Discussion Select an answer first