Increasing Security Awareness CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a security test, a tester observes that a developer, when asked to fix a critical bug quickly, copies a code snippet from a public forum without reviewing it. The snippet contains a known vulnerability. What human factor is primarily demonstrated in this scenario?

   • ASocial engineering by an external attacker
   • BCognitive bias, specifically the tendency to take shortcuts under time pressure
   • CComplacency due to over-reliance on automated tools
   • DLack of technical skill in secure coding
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is evaluating different awareness training methods for a small, co-located team of developers. The team is highly experienced but has a culture of skipping documentation. Which method is most likely to be effective in this context?

   • AA short, interactive lunch-and-learn session with real-world examples from the team's own codebase
   • BA comprehensive written security policy document distributed for self-study
   • CA lengthy, mandatory online course with a final exam
   • DA series of external security conferences that team members can attend individually
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common method to increase security awareness among stakeholders?

   • ARelying solely on automated security scanning tools
   • BRestricting access to security information to only a few people
   • CConducting regular security awareness training sessions
   • DImplementing strict password policies without explanation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security tester discovers that a developer, under deadline pressure, disabled input validation in a payment module to run a quick performance test, then forgot to re-enable it before the build was promoted to staging. The tester needs to address this human-factor risk beyond just filing a bug. Which action best applies security awareness principles to prevent recurrence?

   • ARequire the developer to attend a one-time security training course
   • BAdd a mandatory code-review checklist item requiring validation re-enablement before any build promotion
   • CReport the developer to the project manager for disciplinary action
   • DSend a company-wide email warning about the dangers of disabling security controls
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a penetration test, a tester successfully phishes an employee using a realistic fake login page. The employee enters credentials, and the tester gains access to a non-critical internal wiki. The tester wants to use this finding to improve the organization's security posture. What is the most effective awareness-focused follow-up action?

   • APrivately inform the employee and provide targeted coaching on identifying phishing indicators, using the specific email as a teaching example
   • BPublicly disclose the employee's name in a security newsletter to deter others from falling for similar attacks
   • CIgnore the incident because the wiki is non-critical and the credentials have limited access
   • DImmediately revoke the employee's access and require them to complete a mandatory phishing simulation module
   Reveal Solution Discussion Select an answer first