Security Test Maintenance CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which action is appropriate when updating a security test case to reflect a new threat?

   • ARemove all existing test steps to avoid conflicts
   • BAdd new test steps that simulate the attack vector associated with the threat
   • CChange the test case's priority to low to reduce its importance
   • DMark the test case as obsolete without further action
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is regression testing important after a security fix?

   • ATo update the test environment
   • BTo test the system's usability
   • CTo verify that the fix works as intended
   • DTo ensure that the fix did not introduce new vulnerabilities in other areas
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which situation would necessitate updating security tests?

   • AThe system's uptime increases by 1%
   • BThe test team adopts a new naming convention for test cases
   • CA new version of the test management tool is released
   • DA new regulatory requirement for data protection is introduced
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security testing team maintains a suite of web application tests. The team receives a notification from a threat intelligence feed about a newly discovered vulnerability in the specific version of the content management system (CMS) used by the company's public website. The vulnerability allows unauthenticated remote code execution. The team's current test suite does not include a test for this vulnerability. What should the team do?

   • AWait until the next scheduled test cycle to add the test case, as the current cycle is already complete.
   • BRemove the CMS from the test scope because the vulnerability is in a third-party component, not the company's code.
   • CAdd a new test case that attempts to exploit the newly disclosed vulnerability in the CMS.
   • DUpdate the test environment to the latest CMS version before adding any new test cases.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security testing team is responsible for a web application that processes personal data. The company has just been informed that a new data protection regulation will take effect in three months, requiring that all personal data be encrypted at rest. The application currently stores data in plaintext. The team has a test suite that includes data storage tests. What is the most appropriate approach for the team?

   • ARemove the data storage test cases because the regulation will change the storage architecture.
   • BUpdate the existing data storage test cases to verify that encryption at rest is implemented, and add new test cases for the encryption implementation.
   • CWait until the regulation takes effect to update the test cases, as the system has not changed yet.
   • DRun the existing test cases to establish a baseline before making any changes.
   Reveal Solution Discussion Select an answer first