Security Test Execution and Evaluation CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security tester has completed a penetration test and is writing the final report. The tester found a critical vulnerability in a web application that allows an attacker to read arbitrary files from the server. The tester also found several medium-severity vulnerabilities. The report will be shared with the IT manager, who is not a security expert. What is the most appropriate way to present the critical vulnerability?

   • AExplain the vulnerability in business terms, focusing on the potential impact, such as data breach or system compromise.
   • BOnly mention the critical vulnerability and omit the medium-severity findings to keep the report concise.
   • CDescribe the vulnerability in technical detail, including the exact HTTP request used to exploit it.
   • DProvide a list of all vulnerabilities with their severity ratings, but no additional explanation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which characteristic is most essential for a security test environment to ensure that test activities do not interfere with production operations?

   • AScalability
   • BRealism
   • CControllability
   • DIsolation
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is realism an important characteristic of a security test environment?

   • AIt reduces the cost of the test environment.
   • BIt allows testers to control the environment's configuration.
   • CIt ensures the test environment is isolated from production.
   • DIt helps produce test results that accurately reflect real-world behavior.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a security test evaluation criterion?

   • AThe time it took to set up the test environment.
   • BThe percentage of identified threats that were tested.
   • CThe number of testers on the team.
   • DThe cost of the test tools used.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of monitoring the execution of security tests?

   • ATo automatically fix vulnerabilities found during testing.
   • BTo reduce the time required for testing.
   • CTo replace the need for test documentation.
   • DTo ensure tests run as intended and capture necessary evidence.
   Reveal Solution Discussion Select an answer first