Foundations of Security Testing CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is implementing a new customer relationship management (CRM) system. The system will store personal data of customers in multiple countries, including the European Union (EU) and the United States. The EU's General Data Protection Regulation (GDPR) requires that personal data of EU citizens be protected, and the company's internal policy requires that all security testing be performed by an internal team. The security testing team is planning the scope of testing. Which approach best balances the regulatory requirements and the internal policy?

   • AConduct security testing on the entire CRM system, focusing on data protection controls that address GDPR requirements, using the internal team.
   • BDefer security testing until after the system is deployed to avoid delays.
   • COutsource security testing to an external vendor to ensure GDPR compliance.
   • DLimit security testing to only the EU customer data components to save time.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security tester is explaining to a developer why security testing is important even though the organization has implemented information assurance measures. Which statement best explains the relationship?

   • ASecurity testing is unnecessary if information assurance measures are in place.
   • BInformation assurance sets the overall security posture, but security testing verifies that the implemented controls actually work.
   • CInformation assurance is only about policies, while security testing is only about technical controls.
   • DSecurity testing replaces the need for information assurance.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software development team is integrating security testing into their agile process. The team lead wants to ensure that security testing is not just a final phase but is woven throughout the development lifecycle. Which approach best reflects the role of security testing within the overall software testing process?

   • AConducting security testing activities in parallel with functional testing at each iteration
   • BPerforming a comprehensive security test only after the software is fully developed
   • CDeferring all security testing to an external audit team just before release
   • DRelying solely on automated security scanning tools without manual review
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is developing a new online payment system. The security team has identified that the system processes credit card data and is subject to PCI DSS requirements. The team is planning security testing to ensure that the system protects cardholder data. Which primary goal of security testing is most directly aligned with this planning?

   • AVerifying that the payment system meets all functional requirements
   • BConfirming that the payment system can handle a high volume of transactions
   • CEnsuring that the payment system is user-friendly
   • DAssessing risks to cardholder data and identifying vulnerabilities that could lead to data breaches
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security manager is reviewing the organization's approach to protecting its information assets. The organization has implemented a comprehensive information assurance program that includes policies, risk management, and security controls. However, a recent security incident revealed a vulnerability that was not detected by the existing controls. The manager is considering how to prevent similar incidents. Which action best addresses the gap between information assurance and security testing?

   • AUpdate the information assurance policies to include more stringent requirements.
   • BConduct regular security testing, including penetration testing and vulnerability assessments, to verify that the information assurance controls are effective.
   • CIncrease the budget for information assurance training for all employees.
   • DImplement additional security controls without testing the existing ones.
   Reveal Solution Discussion Select an answer first