Security Test Execution and Evaluation CT-SEC Practice Questions (Page 5)

Questions 21–22

1. 21expert · hard

   A security tester is conducting a penetration test on a web application. The test plan includes both automated scanning and manual testing. The automated scanner has completed its run and reported several potential vulnerabilities. The tester is now performing manual verification. During manual testing, the tester discovers a critical vulnerability that the scanner did not report. The tester also notices that the scanner's report includes a vulnerability that the tester cannot reproduce manually. The test is running behind schedule. What should the tester do?

   • ADocument the critical vulnerability found manually, mark the unreproducible scanner finding as a false positive, and continue manual testing of other areas.
   • BStop manual testing and rely on the scanner's results, as the scanner is more comprehensive and the test is behind schedule.
   • CFocus on manually verifying the scanner's findings and report the critical vulnerability found manually as a separate finding.
   • DReport the critical vulnerability immediately to management and stop the test, as the presence of a critical vulnerability indicates the test is complete.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What should a security test report include to be considered 'actionable'?

   • AThe names of all testers involved.
   • BDetailed descriptions of vulnerabilities and recommended remediation steps.
   • CThe total cost of the testing effort.
   • DA list of all tools used during testing.
   Reveal Solution Discussion Select an answer first