Evaluating Security Testing Practices for Improvements CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to implement a structured methodology to improve its security testing practices. They have a small team and limited resources. They want to focus on the most critical risks first. Which of the following approaches best aligns with a risk-based testing methodology?

   • APrioritize testing of applications that handle sensitive data or are critical to business operations.
   • BTest only the applications that are most frequently used by customers.
   • CTest applications in the order they were developed, starting with the oldest.
   • DTest all applications equally, regardless of their business criticality.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key characteristic of an effective security testing practice evaluation?

   • AIt focuses only on the number of test cases executed, ignoring results
   • BIt relies solely on the tester's intuition to judge the practice's quality
   • CIt uses predefined, measurable criteria to assess the practice's performance
   • DIt is performed only after a security incident occurs
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a security testing program that is heavily reliant on a single senior penetration tester. This tester is the only person who understands the full architecture of the legacy systems. The company is planning to migrate to a new cloud-based architecture. The security team wants to improve its testing practices to be more resilient and prepared for the migration. What is the most critical improvement to make?

   • AImmediately begin penetration testing the new cloud architecture in parallel.
   • BOutsource all penetration testing to an external vendor to reduce dependency on the senior tester.
   • CDocument the current architecture and testing processes, and cross-train other team members.
   • DPurchase a new cloud-native security testing tool to prepare for the migration.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a structured improvement methodology that can be applied to security testing?

   • ANetwork penetration testing
   • BAgile sprint planning
   • CWaterfall development model
   • DPlan-Do-Check-Act (PDCA) cycle
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's security team has been performing penetration tests for years. They track the number of findings and the time to remediate. They notice that the time to remediate has been increasing, and the number of repeat findings is also rising. The team wants to evaluate the effectiveness of their security testing practice. What is the most important metric to analyze to understand this trend?

   • AThe percentage of vulnerabilities that are fixed within the agreed-upon SLA.
   • BThe number of security testers on the team.
   • CThe total number of vulnerabilities found in each test.
   • DThe cost of the penetration testing tools.
   Reveal Solution Discussion Select an answer first