The Benefits of Using Security Testing Standards CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization's security testing process is inefficient because testers often spend time on low-priority issues while missing critical vulnerabilities. The organization wants to improve the quality of testing by focusing on the most important risks. What is the best way to achieve this?

   • AUse a vulnerability scanner that reports all findings without prioritization.
   • BIncrease the number of testers to cover more potential vulnerabilities.
   • CAsk testers to rely on their experience to decide what to test.
   • DAdopt a security testing standard that includes risk-based testing guidelines and prioritization criteria.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company must comply with a regulation that requires security testing to be performed 'in accordance with a recognized standard.' The company has a mature internal testing process that is not formally aligned with any standard. The compliance deadline is in three months, and the budget is limited. What is the most effective approach?

   • AAbandon the internal process and implement a new process from scratch based on the standard.
   • BHire an external firm to conduct all security testing and certify that it follows the standard.
   • CMap the existing internal process to a recognized standard and document the mapping, addressing any gaps.
   • DClaim that the internal process is equivalent to the standard without formal documentation.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How can security testing standards assist an organization in meeting contractual security requirements?

   • ABy automatically generating compliance reports for the contracting party
   • BBy overriding any conflicting contractual clauses
   • CBy offering a recognized baseline that can be referenced in contracts and audits
   • DBy providing a predefined set of test cases that guarantee contract compliance
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization wants to benchmark its security testing process against industry best practices and identify areas for improvement. The organization currently has no formal testing process. What is the most effective first step?

   • AHire a security consultant to perform a one-time penetration test.
   • BCreate an internal team to define a testing process from scratch.
   • CPurchase a commercial security testing tool and use it to scan the organization's systems.
   • DAdopt a recognized security testing standard as a baseline and assess current practices against it.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which benefit do security testing standards provide for communication with non-technical stakeholders?

   • AThey restrict communication to only high-level summaries.
   • BThey provide a common framework that helps translate technical findings into business-relevant terms.
   • CThey eliminate the need to explain technical details to non-technical stakeholders.
   • DThey require that all communication be handled by external consultants.
   Reveal Solution Discussion Select an answer first