Lifecycle Overview CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is adopting a shift-left approach to security testing. Which change best exemplifies this approach?

   • AOutsourcing security testing to an external vendor
   • BIncluding security requirements and threat modeling in the initial project planning
   • CIncreasing the number of security testers in the testing phase
   • DPerforming security testing only after the application is deployed
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A legacy application is being modernized. The team wants to introduce security testing but has limited resources. They must choose between performing threat modeling during design or conducting penetration testing after deployment. Which choice is more aligned with lifecycle security principles?

   • ASkip security testing until after the modernization is complete
   • BConduct penetration testing after deployment to find real-world vulnerabilities
   • CPerform threat modeling during design to identify and mitigate risks early
   • DDo both, but only if the budget allows
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A project manager is comparing two projects: Project A performs security testing continuously throughout the lifecycle, while Project B performs security testing only at the end. Which statement best describes the expected outcome?

   • ABoth projects will have similar outcomes if the testers are equally skilled
   • BProject A is likely to have fewer security defects and lower remediation costs than Project B
   • CProject B will have lower overall costs because testing is done only once
   • DProject B is likely to have fewer security defects because testing is more focused
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After a web application has been in production for several months, a new critical vulnerability is disclosed. Which security activity is most appropriate during the maintenance phase?

   • AConduct a design review of the original architecture
   • BPerform a requirements elicitation session for the next release
   • CRun a static analysis tool on the production environment
   • DApply a security patch and verify that the fix does not introduce regressions
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a primary benefit of shift-left security testing?

   • AIt allows security testing to be performed only by the security team.
   • BIt eliminates the need for any security testing after deployment.
   • CIt ensures that all security vulnerabilities are found before any code is written.
   • DIt reduces the cost and effort of fixing vulnerabilities by detecting them early.
   Reveal Solution Discussion Select an answer first