The Role of Risk Assessment in Security Testing CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After completing a security test, the testing team found a critical vulnerability in a customer-facing application. The vulnerability could allow unauthorized access to customer data. The team must report this to the stakeholders, who include both technical and non-technical members. What is the most effective way to communicate this finding?

   • AOnly report the vulnerability to the technical team and exclude other stakeholders to avoid panic
   • BWait until the vulnerability is fixed before reporting it to anyone
   • CExplain the vulnerability in business terms, describing the potential impact on customers and the company, and outline the recommended next steps
   • DPresent the technical details of the vulnerability, including the exact exploit code, to all stakeholders
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A risk assessment for an e-commerce platform identifies that the payment processing module has a high likelihood of a cross-site scripting (XSS) attack due to insufficient input validation. The impact is rated as high because it could lead to session hijacking and financial fraud. Which test design approach is most aligned with the risk assessment findings?

   • ADesign a comprehensive test suite that covers all input fields in the payment module with XSS payloads
   • BDesign a test suite that checks the payment module's compliance with PCI-DSS standards
   • CDesign a test suite that verifies the payment module's integration with the inventory system
   • DDesign a test suite that focuses on the performance of the payment module under heavy load
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key element of effective risk communication to stakeholders?

   • APresenting risks in terms of business impact and likelihood
   • BFocusing only on the technical details of each vulnerability
   • CReporting only the risks that have been fully mitigated
   • DUsing highly technical jargon to demonstrate expertise
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security testing team has completed a risk assessment and identified several vulnerabilities in a web application. The team needs to communicate the findings to the executive board, which is primarily concerned with business impact. What is the most appropriate way to present the risk assessment findings?

   • APresent the findings only to the IT department and exclude the executive board
   • BFocus on the number of vulnerabilities found and the time taken to test
   • CProvide a detailed technical report with CVSS scores and exploit code
   • DSummarize the findings in terms of potential financial loss, regulatory impact, and reputational damage
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software company is planning the security testing for a new customer-facing web application. The risk assessment identified two high-priority risks: SQL injection in the search feature and a denial-of-service (DoS) vulnerability in the file upload feature. The testing team has limited time and budget. What is the most appropriate way to plan the testing activities?

   • ATest the DoS vulnerability first because it is easier to test
   • BTest the SQL injection risk first because it is listed first in the risk register
   • CPrioritize testing based on the risk ratings, focusing on the highest-rated risk first
   • DAllocate equal testing time to both risks to ensure comprehensive coverage
   Reveal Solution Discussion Select an answer first