Improving Security Testing Practices CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is integrating security testing into a CI/CD pipeline. They want to catch vulnerabilities early without slowing down development. Which approach best achieves this goal?

   • APerform manual security reviews after each release
   • BOnly run security tests when a developer requests them
   • CRun static application security testing (SAST) on every commit and dynamic analysis on release candidates
   • DRun a full penetration test on every code commit
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key benefit of establishing a feedback loop between security testing and development teams?

   • AIt helps developers understand and address security issues earlier in the development lifecycle
   • BIt ensures that all security vulnerabilities are automatically fixed
   • CIt eliminates the need for security testing in future releases
   • DIt guarantees that security testing will be performed by the development team
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security testing team is evaluating the effectiveness of their testing program. They have data on the number of vulnerabilities found, but they want to know if the program is actually reducing risk. Which metric would be most useful for this purpose?

   • ATotal number of tests performed
   • BNumber of vulnerabilities found per test
   • CTime to remediate critical vulnerabilities
   • DNumber of security testers on the team
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security testing team is planning the next penetration test. They have limited time and budget. Which approach would most effectively use their resources?

   • ATest only the systems that were tested last year
   • BFocus on systems that handle sensitive data and are internet-facing
   • CTest all systems equally regardless of risk
   • DRandomly select systems to test
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security testing team is testing a mobile application that stores sensitive user data on the device. The team has identified a vulnerability that requires physical access to the device to exploit. The client wants to know if this is a high-risk issue. What should the team consider?

   • AThe risk is low because physical access is required
   • BThe risk cannot be determined without a full penetration test
   • CThe risk is high because the data is sensitive
   • DThe risk depends on the likelihood of physical access and the impact of data exposure
   Reveal Solution Discussion Select an answer first