Types and Purposes of Security Testing Tools CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network administrator wants to proactively identify open ports and running services on all internal hosts to detect unauthorized services that may have been installed by employees. The administrator needs a tool that can scan the network and provide a list of open ports and associated services. Which type of tool should be used?

   • AA network security tool that performs port scans and service discovery
   • BA SIEM tool that aggregates logs from the hosts
   • CA forensic tool that analyzes disk images from the hosts
   • DA vulnerability scanner that checks for known CVEs on the hosts
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of forensic tools?

   • ATo simulate attacks on a system
   • BTo aggregate security events for monitoring
   • CTo automatically detect known vulnerabilities
   • DTo collect and analyze digital evidence after a security incident
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the main purpose of dynamic analysis tools in security testing?

   • ATo collect forensic evidence from compromised systems
   • BTo identify vulnerabilities by observing the application's behavior during execution
   • CTo model potential threats to the system architecture
   • DTo review source code for coding standard violations
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of web application security tools?

   • ATo assess database configurations for security
   • BTo test web applications for security issues
   • CTo collect digital evidence after an incident
   • DTo monitor network traffic for intrusions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is building a file upload feature for a web application and wants to test how the application handles unexpected file types, oversized files, and malformed file headers. The developer wants to automate this testing by sending a wide variety of malformed files to the upload endpoint. Which type of tool should be used?

   • AA vulnerability scanner that checks the web server for known CVEs
   • BA network sniffer that captures traffic to the upload endpoint
   • CA static analysis tool that reviews the file upload code for vulnerabilities
   • DA fuzzing tool that generates malformed file inputs and sends them to the upload endpoint
   Reveal Solution Discussion Select an answer first