System, Acceptance, and Maintenance CT-SEC Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A company is in the acceptance testing phase for a new customer portal. The contract requires that the portal be compliant with GDPR. The user acceptance team has tested the functionality, but the security team is concerned about data privacy. What should the security testers do to ensure GDPR compliance is validated?

   • ARely on the user acceptance team's functional testing to cover GDPR requirements.
   • BPerform a penetration test to check for GDPR compliance.
   • CDefer GDPR compliance testing to the maintenance phase.
   • DConduct a data protection impact assessment and test data privacy controls, such as consent and data deletion.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is planning to decommission an old application that stores sensitive data. The maintenance team is responsible for the decommissioning process. What security testing activity should be performed?

   • ASkip security testing because the application is being decommissioned.
   • BConduct a penetration test on the old application.
   • CPerform a regression test on the old application to ensure it still works.
   • DVerify that all sensitive data is securely deleted and that no residual data remains in backups or logs.
   Reveal Solution Discussion Select an answer first
3. 23expert · hard

   A company is developing a new application that will process sensitive customer data. The project is behind schedule, and the project manager proposes to skip security testing during system testing and rely on acceptance testing to catch any issues. What should the security testers advise?

   • ASecurity testing should not be skipped in system testing because it is essential for verifying security requirements early.
   • BThe team should skip security testing and instead perform a penetration test after deployment.
   • CThe team can skip security testing if the application is not internet-facing.
   • DSkipping system testing is acceptable if acceptance testing is thorough.
   Reveal Solution Discussion Select an answer first