Security Test Evaluation CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which factor is commonly used to prioritize security findings?

   • AThe name of the tool that discovered the finding
   • BThe number of characters in the vulnerability description
   • CBusiness impact of the affected asset
   • DThe order in which the finding was discovered
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important to evaluate existing security controls during security test evaluation?

   • ATo determine whether the controls are sufficient to mitigate the identified vulnerabilities
   • BTo replace all controls with newer ones
   • CTo assign a cost to each control
   • DTo prove that all controls are working perfectly
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration test reveals two vulnerabilities in a financial application: (1) a critical SQL injection in a transaction processing function that could allow an attacker to modify transaction amounts, and (2) a high-severity cross-site scripting (XSS) in a customer feedback form that could be used to steal session cookies. The application is used by a small number of internal employees, and the transaction function is only accessible after authentication. The feedback form is public. Which vulnerability should be prioritized for remediation?

   • ABoth equally, because both are high-severity vulnerabilities.
   • BThe SQL injection, because it has a higher technical severity and could lead to financial fraud.
   • CThe XSS, because it is easier to exploit and requires no authentication.
   • DThe XSS, because it is public-facing and could affect a larger number of users.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does evaluating the effectiveness of a security control mean?

   • AChecking whether the control is installed on the latest version
   • BCounting how many controls are deployed in the environment
   • CDetermining whether the control actually reduces the risk of the vulnerability being exploited
   • DVerifying that the control is listed in the security policy
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key characteristic of an actionable security test report?

   • AIt focuses only on the positive aspects of the system
   • BIt includes clear recommendations for remediation
   • CIt lists all findings in random order
   • DIt contains only technical jargon
   Reveal Solution Discussion Select an answer first