Security Test Evaluation CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A penetration test reveals two vulnerabilities: (1) a reflected XSS in a public marketing site with no authentication, and (2) a stored XSS in an internal admin panel that requires a valid admin account. The marketing site has a high volume of visitors, while the admin panel is used by only five employees. Which vulnerability should be prioritized for remediation?

   • AThe reflected XSS, because it affects a public-facing system with a larger potential victim pool.
   • BBoth equally, because both are XSS and have the same technical severity.
   • CThe stored XSS, because it can lead to persistent compromise of admin accounts and higher impact on the internal system.
   • DThe reflected XSS, because it is easier to exploit and requires no special privileges.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of root cause analysis in security testing?

   • ATo calculate the total cost of the security test
   • BTo list all the symptoms of the vulnerability in the report
   • CTo identify the underlying reason why a vulnerability exists so that remediation can address the source
   • DTo determine which tester is responsible for missing the vulnerability
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security assessment finds a vulnerability in a legacy application that is scheduled for decommissioning in six months. The vulnerability is a critical remote code execution (RCE) that requires authentication. The application is accessible only from the internal network, and the authentication is required for all users. The company has a compensating control: a network segmentation rule that restricts access to the application to a small group of administrators. What is the most appropriate risk-based recommendation?

   • ARecommend immediate remediation and also implement additional monitoring, because the risk is too high to accept.
   • BAccept the risk because the application is being decommissioned and the compensating controls are sufficient.
   • CRecommend compensating controls and a formal risk acceptance, given the short remaining lifespan and the existing network segmentation.
   • DImmediately remediate the vulnerability because it is critical, regardless of the compensating controls.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is root cause analysis important for effective remediation?

   • ABecause fixing the root cause prevents the same vulnerability from recurring in other places
   • BBecause it automatically patches the vulnerability
   • CBecause it eliminates the need for any further security testing
   • DBecause it is faster than fixing the symptom
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a false negative in security testing?

   • AA vulnerability that is detected but is not exploitable
   • BA real vulnerability that the test did not detect
   • CA reported vulnerability that does not exist
   • DA test result that is inconclusive and requires retesting
   Reveal Solution Discussion Select an answer first