People, Process and Technology CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security testing team is planning a penetration test for a critical application. The team lead assigns the test to a junior tester who has just completed a security certification but has no hands-on experience with the specific technology stack. The test must be completed within a tight deadline. What is the most effective approach to ensure the test's success?

   • AReplace the junior tester with an automated scanning tool to avoid human error and speed up the process.
   • BAssign a senior tester to mentor the junior tester and review the findings before the report is issued.
   • CLet the junior tester work independently to gain experience, as the certification should be sufficient.
   • DDelay the test until the junior tester has completed a formal training course on the specific technology stack.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security tester is testing a mobile application that communicates with a backend server. The tester needs to verify that the application correctly validates SSL certificates. Which technology is most appropriate for this test?

   • AA fuzzing tool to send malformed data to the application.
   • BA password cracking tool to test authentication.
   • CA proxy that presents a self-signed certificate to the application.
   • DA network scanner to identify open ports on the server.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security testing team is conducting a social engineering test. The team plans to send phishing emails to employees to assess their awareness. Which human factor is most important to consider when designing the test?

   • AThe employees' level of security awareness and training.
   • BThe time of day the emails are sent.
   • CThe type of email server used by the organization.
   • DThe number of security tools deployed in the organization.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is implementing a new continuous security testing process for a DevOps environment. The team has a limited budget and must choose between investing in automated security testing tools or hiring additional security testers. The organization values rapid feedback and has a culture of collaboration between developers and security. Which approach best aligns with the principles of people, process, and technology?

   • AHire more security testers to manually review every code change.
   • BInvest only in automated tools and rely on them to find all vulnerabilities.
   • CHire a security consultant to periodically assess the system.
   • DInvest in automated tools and train developers to use them, while maintaining a small team of security experts for oversight.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security testing team is conducting a code review to identify security issues. The team includes a developer who wrote the code and a security specialist. The developer is confident that the code is secure. Which human factor is most likely to affect the effectiveness of the review?

   • AThe developer's overconfidence in their own code.
   • BThe security specialist's lack of familiarity with the programming language.
   • CThe time of day the review is conducted.
   • DThe team's use of automated code analysis tools.
   Reveal Solution Discussion Select an answer first