People, Process and Technology CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security tester is documenting the results of a penetration test. The tester has identified a critical vulnerability in a web application. According to best practices for security testing processes, what should the tester include in the final report?

   • AThe vulnerability details, but only to the development team, not to management.
   • BA list of all tools used during the test, without vulnerability details.
   • COnly the vulnerability's name and the affected URL, to keep the report concise.
   • DA detailed description of the vulnerability, its potential impact, and recommended remediation steps.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security testing team is about to start a new project. The team lead wants to ensure that all members understand their roles and responsibilities. Which process artifact is most effective for this purpose?

   • AA detailed project plan with timelines and milestones.
   • BA communication plan outlining meeting schedules.
   • CA roles and responsibilities matrix (RACI chart).
   • DA list of security testing tools to be used.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which skill is most essential for a security tester to accurately interpret the results of a vulnerability scan?

   • AAbility to write marketing reports
   • BExperience in project management
   • CKnowledge of networking protocols
   • DSkill in graphic design
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security testing team is struggling to keep up with the number of vulnerabilities being reported by their automated scanner. The team is spending too much time triaging false positives and not enough time on actual testing. The team lead wants to improve the efficiency of the process. Which combination of actions would be most effective?

   • AConfigure the scanner to reduce false positives and train the team on how to interpret scanner results.
   • BAssign the least experienced team member to triage the results.
   • CIncrease the frequency of scans to catch more vulnerabilities.
   • DReplace the automated scanner with manual testing to eliminate false positives.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which scenario best illustrates the effective interplay of people, process, and technology in security testing?

   • AA tester relies solely on an automated scanner and does not review the results manually
   • BA skilled tester uses an automated scanner, follows a defined test plan, and communicates findings to the development team for remediation
   • CA development team fixes vulnerabilities without any formal testing process
   • DA security team uses manual testing only, without any tools or defined process
   Reveal Solution Discussion Select an answer first