Where to Learn of Industry Trends in Information Security CT-SEC Practice Questions (Page 6)

Questions 26–29

1. 26expert · hard

   A security tester is reviewing the latest threat intelligence from multiple sources. One source reports a new zero-day vulnerability in a widely used VPN gateway, and another source reports a new phishing campaign targeting the company's industry. The tester has limited time and must decide which threat to prioritize for immediate testing. The VPN gateway is used by all remote employees, and the phishing campaign uses a new technique that bypasses the current email filter. Which threat should the tester prioritize?

   • AThe VPN zero-day vulnerability, because it affects a critical infrastructure component used by all remote employees
   • BNeither threat, since the reports are from unverified sources
   • CThe phishing campaign, because it is actively targeting the company's industry
   • DBoth threats equally, since they are both reported by industry sources
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester notices a sharp increase in attacks exploiting a newly disclosed vulnerability in a widely used content management system. The tester needs to quickly confirm the technical details, affected versions, and available mitigations from a vendor-neutral source. Which source should the tester consult first?

   • ANIST National Vulnerability Database (NVD)
   • BOWASP Top 10
   • CISACA COBIT framework
   • DSANS Reading Room
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a recent regulatory or compliance change that affects information security?

   • AThe creation of the Payment Card Industry (PCI) standards
   • BThe introduction of the EU Cybersecurity Act
   • CThe repeal of the Computer Fraud and Abuse Act (CFAA)
   • DThe adoption of the Data Protection Directive 95/46/EC
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How has the trend of DevOps and continuous delivery influenced security testing methodologies?

   • AIt has eliminated the need for security testing in software development.
   • BIt has made security testing a separate phase after deployment.
   • CIt has led to the integration of security testing into CI/CD pipelines, often called DevSecOps.
   • DIt has shifted all security testing to manual penetration testing only.
   Reveal Solution Discussion Select an answer first