Setting Security Testing Goals and Objectives CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is planning a security test of its new microservices architecture. The objective is to identify vulnerabilities that could allow an attacker to access sensitive data. The architecture includes multiple services, an API gateway, and a database. The company has a limited budget and must decide what to include in the scope. What is the best approach?

   • AInclude only the database, since it stores the sensitive data.
   • BInclude the API gateway, all services that handle sensitive data, and the database in the scope.
   • CInclude only the API gateway, since it is the entry point.
   • DInclude all components, regardless of whether they handle sensitive data.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security test lead is planning a test for a new cloud-based application. The application stores personal data and is subject to data residency requirements. The legal team requires that the test verify that data does not leave the country. The development team wants to test the application's performance under load. The security team has a limited budget. What should the security test lead do?

   • ATest the application in a different region to see if data residency is enforced.
   • BInclude performance testing in the security test to satisfy the development team.
   • CDefine security test objectives that focus on data residency and data protection, and exclude performance testing from the security test scope.
   • DAsk the legal team to provide a list of data residency requirements and turn them into test cases, without involving the development team.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of specifying the coverage of security testing?

   • ADeciding to allocate three weeks for the testing phase
   • BDeciding to test both the authentication and authorization mechanisms, including negative test cases
   • CDeciding to use a specific commercial vulnerability scanner
   • DDeciding to hire an external security testing consultant
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security tester is asked to test a new single sign-on (SSO) system. The goal is to 'ensure secure authentication'. The tester has limited time and must decide which objectives to focus on. The system uses OAuth 2.0 and SAML. Which of the following is the most appropriate set of security test objectives?

   • AVerify that the system is compatible with all major browsers.
   • BVerify that OAuth 2.0 authorization codes are not leaked, and that SAML assertions are properly validated.
   • CTest the system's performance under load.
   • DTest the system's user interface for usability issues.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security test lead is tasked with testing a new authentication service. The goal is to 'improve authentication security'. Which of the following is the most specific and measurable security test objective derived from this goal?

   • AVerify that the authentication service is secure against common attacks.
   • BEnsure the authentication service works correctly for all users.
   • CAttempt to bypass authentication using at least five common techniques (e.g., SQL injection, brute force) and document any successful bypass.
   • DTest the authentication service for vulnerabilities.
   Reveal Solution Discussion Select an answer first