Evaluating Security Testing Practices for Improvements CT-SEC Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A company's security team wants to implement a new security testing methodology. They have a limited budget and a small team. They need to choose between implementing a comprehensive SAST tool across their entire codebase or implementing a targeted DAST solution for their top 5 critical web applications. The team's goal is to reduce the number of high-severity vulnerabilities in production. Which approach is more likely to achieve this goal in the short term?

   • ADelay the implementation and first conduct a full audit of all existing vulnerabilities.
   • BImplement the DAST solution on the top 5 critical applications, as it focuses on the highest-risk assets.
   • CImplement the SAST tool across the entire codebase, as it provides the broadest coverage.
   • DUse the budget to hire more penetration testers to perform manual testing.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the main goal of identifying improvement opportunities in security testing practices?

   • ATo prove that the current security testing is flawless
   • BTo comply with a one-time audit requirement
   • CTo find gaps and areas where the security testing process can be enhanced
   • DTo reduce the security testing team's workload
   Reveal Solution Discussion Select an answer first
3. 23expert · hard

   A large e-commerce company has a mature security testing program. They perform SAST on every commit, DAST on every staging build, and a full penetration test before each major release. The program has a low false-positive rate and high code coverage. However, the security team is concerned that they are not effectively testing the security of their microservices architecture, which has grown to over 200 services. They want to evaluate the effectiveness of their current practices against this new architecture. What is the most significant gap in their current testing practices?

   • AThe lack of a dedicated security team for each of the 200 microservices.
   • BThe lack of runtime security testing that validates the interactions and data flows between microservices.
   • CThe lack of penetration testing on the production environment instead of staging.
   • DThe lack of a more expensive enterprise-grade SAST tool to handle the scale of 200 services.
   Reveal Solution Discussion Select an answer first