People, Process and Technology CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to have a defined process even when using advanced security testing tools?

   • ATo make the testing process faster by skipping manual analysis
   • BTo eliminate the need for skilled testers
   • CTo guarantee that all vulnerabilities will be found
   • DTo ensure that testing is systematic, repeatable, and aligned with business objectives
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security tester is testing a network infrastructure and needs to identify open ports and services running on a target server. Which technology is most appropriate for this task?

   • AA password cracking tool.
   • BA web application scanner.
   • CA port scanner such as Nmap.
   • DA network intrusion detection system (IDS).
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is implementing a new security testing program. The team has a limited budget and must choose between purchasing an expensive commercial vulnerability scanner or using open-source tools and investing in training for the team. The team is experienced but not familiar with the open-source tools. The organization values thorough testing and has a culture of continuous improvement. Which approach is most aligned with the principles of people, process, and technology?

   • AUse open-source tools and invest in training to build the team's capabilities.
   • BUse both the commercial scanner and open-source tools, but skip training to save costs.
   • COutsource the security testing to a third-party vendor to avoid investing in tools or training.
   • DPurchase the commercial scanner because it is more reliable and requires less training.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security tester is planning to test a new web application that is hosted in a cloud environment. The tester needs to ensure that the testing does not violate the cloud provider's terms of service. Which process step is essential before starting the test?

   • ASelect the most powerful testing tools available.
   • BReview the cloud provider's acceptable use policy and obtain written permission.
   • CPerform the test during off-peak hours to avoid detection.
   • DUse a VPN to hide the testing activity.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which activity is typically performed during the 'reporting' phase of a security testing process?

   • ADocumenting findings, risks, and recommended remediation actions
   • BSelecting the security testing tools to be used
   • CExecuting the actual security tests against the target system
   • DDefining the scope and objectives of the security test
   Reveal Solution Discussion Select an answer first