Where to Learn of Industry Trends in Information Security CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   A security tester at a financial firm is asked to create a monthly briefing for developers on the most critical web application risks. The tester wants a source that is specifically focused on web application security and is widely recognized for its Top 10 risk list. Which source should the tester use as the primary reference?

   • ANIST
   • BISACA
   • COWASP
   • DSANS
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multinational company is updating its security testing program to comply with new data protection regulations in multiple jurisdictions. The company operates in the EU (GDPR) and in California (CCPA). The testing team must ensure that their testing of a new customer data platform verifies compliance with both regulations. A key requirement is to verify that the platform can correctly handle user requests for data deletion. What should the testing team do to address this requirement?

   • AFocus only on GDPR requirements since it is the stricter regulation
   • BPerform a single test to verify data deletion for a sample of users
   • CDesign test cases that verify the data deletion functionality works correctly for all data subjects
   • DAdd a requirement to the test plan to verify that data is deleted from all backups
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a recent attack vector that has been increasingly reported by industry sources?

   • APhysical theft of floppy disks
   • BSupply chain attacks via compromised software dependencies
   • CSocial engineering via fax machine
   • DBuffer overflow attacks on mainframe systems
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a security technology or practice that has been increasingly highlighted in industry publications and conferences?

   • APerimeter-based firewall only
   • BAir-gapped networks for all systems
   • CPassword-only authentication
   • DZero Trust architecture
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security tester working for a company that processes credit card payments is updating their testing checklist to align with the latest version of the industry standard. The standard requires annual external and internal penetration tests and quarterly vulnerability scans. Which standard are they complying with?

   • AGDPR
   • BHIPAA
   • CPCI DSS
   • DISO 27001
   Reveal Solution Discussion Select an answer first