People, Process and Technology CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester is evaluating a web application that uses both a REST API and a legacy SOAP-based service. The tester has a limited budget and must choose a single tool to support the testing effort. Which tool characteristic is most important to consider?

   • AThe tool's ability to generate comprehensive vulnerability reports.
   • BThe tool's ability to intercept and modify both HTTP and HTTPS traffic.
   • CThe tool's user interface and ease of use.
   • DThe tool's support for both REST and SOAP protocols.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which human factor is most likely to reduce the effectiveness of a security test if not addressed?

   • AUse of automated scanning tools
   • BLack of communication between the security testers and the development team
   • CHaving a dedicated security testing team
   • DFollowing a defined testing process
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security testing team is preparing to test a new mobile banking application. The team includes a developer, a network engineer, and a security analyst. The test plan requires both static analysis of the source code and dynamic testing of the running application. Which team member is best suited to lead the static analysis effort?

   • AThe network engineer, because they understand the network architecture.
   • BThe developer, because they have the most familiarity with the codebase.
   • CAny team member can lead, as long as they follow the test plan.
   • DThe security analyst, because they have the most knowledge of security vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of defining a test plan in the security testing process?

   • ATo provide a list of all possible security vulnerabilities in the system
   • BTo document the scope, objectives, and approach of the security testing activities
   • CTo guarantee that all vulnerabilities will be found
   • DTo replace the need for any further documentation during testing
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security tester is setting up a test environment to simulate a potential attacker. The tester needs to intercept and modify network traffic between a client and a server to test the application's security. Which technology is most appropriate for this task?

   • AA vulnerability scanner to identify known issues in the application.
   • BA web application firewall (WAF) to filter malicious traffic.
   • CA network sniffer that captures packets for later analysis.
   • DAn interception proxy that can modify requests and responses in real time.
   Reveal Solution Discussion Select an answer first