Increasing Security Awareness CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A security tester is working with a development team that has a strong culture of 'moving fast' and often deprioritizes security tasks as 'blockers'. The tester wants to improve the team's security awareness and get them to adopt secure practices. Which approach is most likely to succeed in this cultural context?

   • ARequire the team to attend a formal, multi-day security certification course
   • BFrame security practices as enablers of speed, such as preventing costly rework and delays from late-stage security failures
   • CCreate a separate security team that handles all security tasks independently of the development team
   • DEscalate every security issue to senior management to force the team to comply
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security tester is assessing the human factors that could lead to a data breach. The tester interviews employees and finds that many are unaware of the organization's data classification policy and often send sensitive files to personal email accounts for convenience. What is the most significant human-factor risk demonstrated here?

   • AUnintentional human error due to a lack of security awareness
   • BInadequate password complexity requirements
   • CMalicious intent by employees to steal company data
   • DLack of technical security controls, such as firewalls and intrusion detection systems
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A tester is working with a team that consistently delivers features on time but has a history of security issues found late in the release cycle. The tester wants to introduce security awareness to shift the team's focus earlier. Which action best applies security awareness principles to improve the testing process?

   • AHire an external security consultant to fix all issues at the end of the project
   • BAsk the team to read a security book during their spare time
   • CAdd a security-focused discussion to the team's regular backlog grooming and design sessions
   • DConduct a security review only after all features are developed and integrated
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A tester is creating a security test plan for a new application. The tester wants to ensure that security awareness is applied throughout the testing process, not just in the final security test phase. Which approach best achieves this?

   • AIncorporate security awareness briefings and threat-modeling sessions into each phase of the testing lifecycle
   • BFocus all awareness efforts on the testers, as they are the only ones who need to understand security risks
   • CInclude security test cases only in the dedicated security testing phase at the end of the project
   • DRely on the developers to perform their own security testing without any additional awareness activities
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A security tester is performing a risk assessment and identifies that a critical application stores sensitive customer data. The tester finds that developers often use shared service accounts to access the production database for debugging, and these accounts have no individual accountability. What is the primary human-factor risk, and what is the most effective control to mitigate it?

   • ARisk: Lack of technical encryption; Control: Implement database encryption at rest
   • BRisk: Malicious insider threat; Control: Implement a strict background check process for all developers
   • CRisk: Social engineering of developers; Control: Implement a phishing awareness training program
   • DRisk: Unintentional error with no accountability; Control: Implement individual accounts with least-privilege access and audit logging
   Reveal Solution Discussion Select an answer first