Security Test Maintenance CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security testing team is preparing for an audit. The team needs to demonstrate that its security test cases are up to date and that the team has responded to recent changes in the threat landscape. The team's test documentation is stored in a shared network drive with no version control. What is the most appropriate action to prepare for the audit?

   • APrint all test documentation and store it in a binder for the auditors to review.
   • BCreate a new document that summarizes the test cases and their status as of the audit date.
   • CAsk the developers to confirm that the test cases are up to date.
   • DEstablish a version-controlled repository for test documentation and record the dates and reasons for all recent updates.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the goal of continuous improvement in security testing?

   • ATo document all security test results for management
   • BTo reduce the number of security tests to save time
   • CTo ensure that all security tests are automated
   • DTo enhance the effectiveness of future security tests based on lessons learned
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security testing team has a large collection of test data files, including sample payloads, user credentials, and configuration files. The team is concerned that some of the test data may contain sensitive information, such as real user credentials, that was accidentally included. The team also needs to ensure that the test data is up to date with the latest threat intelligence. What is the most appropriate action?

   • ADelete all test data files and recreate them from scratch.
   • BConduct a review of all test data files to identify and remove any sensitive information, and update the data to reflect current threats.
   • CEncrypt all test data files to protect the sensitive information they may contain.
   • DRestrict access to the test data files to only the security testing team.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security tester is working on a web application that has a critical vulnerability in the authentication module. The development team has applied a fix, but the tester is concerned that the fix might have introduced a new vulnerability in the session management module. The tester has a limited time window for testing. What is the most appropriate testing strategy?

   • AOnly run the regression tests for the session management module, as the fix is already confirmed by the developer.
   • BRun the full regression suite to ensure no new vulnerabilities are introduced anywhere.
   • COnly retest the authentication module to confirm the fix is effective.
   • DRetest the authentication module to confirm the fix, then run a focused regression test on the session management module.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which activity is within the scope of security test maintenance?

   • AUpdating test cases to address newly discovered vulnerabilities
   • BDefining the overall security test strategy
   • CReporting security test results to stakeholders
   • DExecuting all security tests for the first time
   Reveal Solution Discussion Select an answer first