Lifecycle Overview CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A project team is using a waterfall model. They want to ensure security is considered throughout the lifecycle. Which approach is most effective?

   • AWait until the maintenance phase to address security
   • BIncorporate security activities into each phase, from requirements through maintenance
   • CHire a security consultant to review the final product
   • DPerform all security testing during the testing phase only
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does continuous security testing differ from testing only at the end of the lifecycle?

   • AContinuous testing requires more manual effort and cannot be automated.
   • BContinuous testing is only applicable to agile projects, not traditional ones.
   • CContinuous testing is performed only during the maintenance phase.
   • DContinuous testing provides faster feedback and allows security issues to be addressed as they arise.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   In a large organization, a security specialist is responsible for overseeing security testing across multiple projects. The specialist has limited time and must prioritize activities. Which activity should the specialist prioritize to have the greatest impact on reducing security risk?

   • AWriting security test cases for every project
   • BAttending every sprint review meeting
   • CReviewing threat models and security requirements for high-risk projects
   • DPerforming penetration tests on all projects after deployment
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   In a DevOps team, developers are responsible for writing code, and security specialists are embedded in the team. The team wants to implement continuous security testing without slowing down the CI/CD pipeline. Which approach best balances speed and security?

   • AAutomate security checks (SAST, dependency scanning) in the pipeline and have security specialists review critical findings
   • BHave developers perform all security testing manually before committing code
   • CPerform security testing only in a separate phase after the pipeline
   • DRequire manual security sign-off before every deployment
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A tester is preparing to verify that a new feature meets its security requirements. Which role is primarily responsible for defining those security requirements?

   • AOperations staff, because they run the system
   • BTesters, because they need to know what to test
   • CBusiness analysts and product owners, with input from security specialists
   • DDevelopers, because they implement the feature
   Reveal Solution Discussion Select an answer first