The Benefits of Using Security Testing Standards CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is bidding for a contract that requires security testing to be performed in accordance with a specific industry standard. The company's current testing process is informal and undocumented. What is the most appropriate action to increase the company's chances of winning the contract?

   • AClaim in the bid that the company's informal process is equivalent to the standard.
   • BFormalize the testing process by aligning it with the required standard and document the alignment.
   • CPropose to use a third-party testing firm that follows the standard.
   • DSubmit a bid that describes the company's current process without mentioning the standard.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How do security testing standards improve communication among stakeholders?

   • ABy requiring all communication to be in writing
   • BBy eliminating the need for status meetings
   • CBy providing a common terminology and framework for discussing testing
   • DBy ensuring that only technical staff are involved in testing discussions
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is working with an external security consultant to conduct a penetration test. The consultant's report uses a vulnerability classification system that the company's internal team is not familiar with, leading to confusion about the severity of findings. What is the most effective way to avoid this confusion in future engagements?

   • AHave the internal team learn the consultant's classification system.
   • BRequire the consultant to use a recognized security testing standard and its associated vulnerability classification.
   • CAvoid using external consultants and conduct all testing internally.
   • DAsk the consultant to provide a glossary of terms with each report.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to improve the way they report vulnerabilities to management. Currently, reports are lengthy and technical, and management has difficulty understanding the business impact. What is the best way to improve communication with management?

   • ASend management the raw technical reports and let them ask questions.
   • BUse a security testing standard that provides a framework for reporting risks in business terms.
   • CAsk management to take a security awareness training course.
   • DCreate a separate report for management that only lists the number of vulnerabilities found.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team is new to security testing and is unsure how to structure their testing activities. They want to ensure they cover all essential areas without missing critical steps. What is the best way to guide them?

   • AAsk them to review security testing reports from other companies.
   • BLet them learn by trial and error on a non-production system.
   • CProvide them with a security testing standard that outlines a structured process and best practices.
   • DHave them use a single automated scanning tool and trust its results.
   Reveal Solution Discussion Select an answer first