Security Test Planning CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In security test planning, what does 'aligning with business objectives' primarily ensure?

   • AThat security testing is performed after all functional testing is complete
   • BThat all security defects are fixed before release
   • CThat the security testing effort supports the organization's goals and priorities
   • DThat the testing team uses the latest security tools
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is planning a security test for a new product that will be launched soon. The test plan must be approved by the product manager, the security team lead, and the legal department. The product manager wants the test to be completed before the launch, but the legal department requires a detailed test plan that includes a risk assessment and data handling procedures. The security team lead is concerned about the scope being too broad. What is the best way to proceed?

   • AAsk the security team lead to approve the plan without involving other stakeholders.
   • BFocus only on the legal department's requirements and ignore the scope concerns.
   • CPrioritize the product manager's deadline and start testing immediately.
   • DCreate a test plan that addresses the concerns of all stakeholders and obtain approval from each before testing.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is planning a test for a legacy system that is critical to daily operations. The system cannot be taken offline, and any disruption could cause significant business loss. How does thorough planning help mitigate this risk?

   • ABy using only automated tools to minimize human error
   • BBy avoiding any testing on the legacy system to prevent disruption
   • CBy scheduling the test during a maintenance window and preparing rollback procedures
   • DBy increasing the number of testers to complete the test faster
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services company is planning a security test of its customer-facing web application. The compliance team requires that the test not disrupt production services, and the legal team requires explicit authorization before any testing begins. The security team has drafted a test plan that includes a scope, schedule, and resource list. What is the most important next step to ensure the plan is executable?

   • ABegin testing immediately to identify vulnerabilities before the next release.
   • BObtain signed approval from the business owner and legal counsel before any testing activity begins.
   • CPurchase additional testing tools to expand the scope of the assessment.
   • DReduce the scope to only non-production systems to avoid any risk of disruption.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security test plan must include a risk assessment that identifies potential issues that could affect the test, such as system downtime or data loss. What is the purpose of including this risk assessment in the plan?

   • ATo provide a list of all known vulnerabilities in the system
   • BTo justify the need for additional testing tools
   • CTo proactively identify and mitigate risks that could impact the test's success
   • DTo document the testers' qualifications
   Reveal Solution Discussion Select an answer first