Security Testing Approaches and Stakeholders CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security test of a web application uses an automated scanner that reports several high-severity vulnerabilities. The development team manually verifies each finding and finds that two are false positives, but one is a real vulnerability. The scanner also missed a critical vulnerability that was found during manual testing. What is the most significant limitation of relying solely on automated scanning?

   • AIt produces false positives that waste time
   • BIt cannot test authentication mechanisms
   • CIt is too slow for large applications
   • DIt produces false negatives that leave vulnerabilities undetected
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An organization is considering gray-box testing for a web application. What is a primary strength of gray-box testing compared to black-box testing?

   • AIt offers partial internal knowledge, which can help focus testing on high-risk areas while still simulating an external perspective
   • BIt provides full access to source code, allowing complete code review
   • CIt eliminates the need for any security testing tools
   • DIt requires no knowledge of the application, making it the most realistic external attack simulation
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester is planning a test for a new web application that will be publicly accessible. The tester has no internal knowledge and wants to identify as many vulnerabilities as possible from an external perspective. However, the tester is concerned about the time and effort required. Which approach is most appropriate?

   • AWhite-box testing with source code review
   • BManual black-box testing only
   • CBlack-box testing with automated scanning tools
   • DGray-box testing with partial credentials
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security test of a web application uses an automated scanner that reports a high-severity vulnerability. The development team argues that the vulnerability is not exploitable because the affected functionality is only accessible to authenticated administrators. The security tester disagrees and believes the vulnerability is still a risk. What is the most important factor in determining the actual risk?

   • AThe likelihood that an attacker could compromise an administrator account
   • BThe severity rating assigned by the scanner
   • CThe business owner's risk tolerance
   • DThe developer's opinion on the exploitability
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security tester is asked to test a new web application that will be publicly accessible. The tester has no internal knowledge, but the client has provided a valid user account for testing. The client wants to know if an external attacker could access other users' data. Which testing approach is most effective for this goal?

   • ABlack-box testing without using the provided account
   • BGray-box testing with partial knowledge of the application
   • CWhite-box testing with source code review
   • DBlack-box testing using the provided account to test for authorization flaws
   Reveal Solution Discussion Select an answer first