Setting Security Testing Goals and Objectives CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When determining the scope of security testing, which of the following should be explicitly defined?

   • AThe systems, components, and data that are included in the testing
   • BThe names of the individual testers who will perform the testing
   • CThe exact vulnerabilities that will be found during testing
   • DThe total cost of the testing project
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security test team is testing a web application that handles personal data. The objective is to identify vulnerabilities that could lead to unauthorized access to personal data. The team has limited time. Which of the following best defines the coverage of this test?

   • ATest all input fields for injection attacks and all pages for access control issues.
   • BTest only the database, since it stores the personal data.
   • CTest only the login page, since it is the entry point.
   • DTest the application's performance under load.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational corporation is subject to the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The security team is planning a test of a new customer data platform. The legal team requires that the test verify compliance with both regulations. The operations team is concerned about the test disrupting production systems. What should the security team do to align the test goals with these requirements?

   • AAsk the legal team to prioritize which regulation is more important.
   • BFocus only on GDPR compliance, as it is more stringent than CCPA.
   • CPerform the test on production systems to get accurate results, despite the risk of disruption.
   • DDefine test objectives that include GDPR and CCPA compliance checks, and scope the test to a staging environment to avoid disruption.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security test team is testing a new e-commerce website. The objective is to identify vulnerabilities that could lead to credit card theft. The website uses a third-party payment processor. The team has a limited budget and must decide on the coverage of the test. The payment processor claims to be PCI DSS compliant. What is the best approach?

   • ATest the entire website, including all features, to ensure comprehensive coverage.
   • BFocus the coverage on the website's payment handling and integration with the payment processor, and verify the processor's compliance claims.
   • CTest the payment processor's systems thoroughly, since they handle credit card data.
   • DTest only the website's front-end, since the payment processor handles the rest.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is preparing for a security test of its new patient portal. The compliance officer insists the test must verify that the portal meets GDPR requirements for data protection. The development team wants to focus on functional bugs. The security manager needs to balance these interests. What should the security manager do first?

   • AStart testing immediately with a broad vulnerability scan to identify any obvious issues.
   • BAsk the compliance officer to list all GDPR requirements and turn them into test cases without involving the development team.
   • CDefine security test objectives that explicitly include GDPR compliance checks and communicate them to stakeholders.
   • DPrioritize the development team's functional testing and address GDPR compliance in a later phase.
   Reveal Solution Discussion Select an answer first