The Role of Risk Assessment in Security Testing CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security testing team has identified a critical vulnerability in a production system. The vulnerability could allow an attacker to gain administrative access. The team has reported the finding to the IT manager, who decides to accept the risk because the system is scheduled for replacement in three months. The security team disagrees with this decision. What is the most appropriate action for the security team?

   • APublicly disclose the vulnerability to force the company to fix it
   • BRefuse to accept the decision and immediately fix the vulnerability without authorization
   • CAccept the decision and document it, but escalate the concern to higher management with a clear explanation of the potential consequences
   • DStop all security testing activities until the decision is reversed
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important to prioritize risks during risk analysis?

   • ATo focus resources on the most significant risks first
   • BTo ensure all risks are treated equally regardless of their severity
   • CTo eliminate the need for further security testing
   • DTo satisfy regulatory requirements for risk documentation
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A risk assessment for a corporate website identifies a vulnerability in the content management system (CMS). The likelihood of exploitation is rated as low because the website is not well-known and has no sensitive data. The impact is also rated as low because a compromise would only deface the public-facing page. According to the risk evaluation criteria, what should the organization do with this risk?

   • AAvoid the risk by taking the website offline
   • BAccept the risk and document it as a low-priority item for future remediation
   • CMitigate the risk by immediately patching the CMS
   • DTransfer the risk by purchasing cyber insurance
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   During risk identification for a web application, which of the following is an example of an asset?

   • AThe customer database containing personal information
   • BThe likelihood of a denial-of-service attack
   • CA SQL injection vulnerability in the login form
   • DA hacker attempting to exploit the system
   Reveal Solution Discussion Select an answer first
6. 5expert · hard · select all that apply

   A security tester is conducting a risk identification activity for a new online payment system. The tester must identify the assets, threats, and vulnerabilities. Which of the following are examples of threats? (Select all that apply.)

   • AA hacker using a phishing attack to steal customer credentials
   • BA distributed denial-of-service (DDoS) attack targeting the payment system
   • CAn insider accidentally deleting the payment system's transaction logs
   • DThe payment system storing credit card numbers in plain text
   • EThe customer's credit card data stored in the database
   Check answers Discussion Select an answer first