Security Test Evaluation CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security test evaluation is being planned for a critical application. The evaluation's purpose is to determine whether the application's security controls are effective and to identify any residual risk. The evaluation team has limited time and budget. What is the most appropriate scope for this evaluation?

   • AFocus on the most critical business functions and the controls that protect them, using a risk-based approach.
   • BFocus only on the controls that are known to be weak, based on previous assessments.
   • CEvaluate only the application's compliance with industry standards, such as OWASP ASVS.
   • DTest all features and controls exhaustively to ensure complete coverage.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In risk-based evaluation, what two factors are primarily used to assess the risk of a vulnerability?

   • ACost of remediation and time to fix
   • BSeverity of the vulnerability and the number of false positives
   • CNumber of test cases and test coverage
   • DLikelihood of exploitation and potential impact
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security assessment identifies a vulnerability in a public-facing web server that allows an attacker to enumerate valid usernames. The server is behind a load balancer that distributes traffic across multiple instances. The vulnerability is present in all instances. The company has a WAF that can be configured to block the enumeration attempts. What is the most appropriate risk-based recommendation?

   • AAccept the risk because username enumeration is a low-severity issue.
   • BImmediately fix the vulnerability in all instances, because it is a public-facing system.
   • CRemove the public-facing server from the internet to eliminate the risk.
   • DConfigure the WAF to block enumeration attempts as a compensating control, and plan to fix the vulnerability in the next release.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has implemented a Security Information and Event Management (SIEM) system to detect and alert on security incidents. The SIEM generates a high volume of alerts, many of which are false positives. The security team is overwhelmed and has started to ignore alerts. A penetration test finds that a real attack was not detected by the SIEM because the attack pattern was not included in the correlation rules. What is the most appropriate evaluation of the SIEM's effectiveness?

   • AThe SIEM should be replaced because it cannot be tuned to meet the company's needs.
   • BThe SIEM is partially effective, but its rules need to be tuned to reduce false positives and include the missed attack pattern.
   • CThe SIEM is ineffective because it generates too many false positives and misses real attacks.
   • DThe SIEM is fully effective because it detects some attacks, and the missed attack is a rare edge case.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A security tester needs to report a critical vulnerability to the CISO, who is not technical. The vulnerability is a remote code execution in a web application that could allow an attacker to take over the server. The CISO needs to understand the business impact and the urgency of remediation. What is the most effective way to communicate this finding?

   • ARecommend immediate remediation without providing details, because the CISO only needs to approve the action.
   • BExplain the vulnerability in terms of business risk, such as potential data breach, financial loss, and reputational damage.
   • CProvide a detailed technical explanation of the exploit, including the exact payload and code path.
   • DInclude the technical details in an appendix and provide a one-line summary in the main report.
   Reveal Solution Discussion Select an answer first