Avoid Vulnerability CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of security testing, which statement best defines a vulnerability?

   • AAn action or event that could cause harm to the system
   • BA weakness in a system that could be exploited by a threat to cause harm
   • CA measure taken to reduce the likelihood of a security incident
   • DThe potential for a threat to exploit a weakness and cause damage
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which secure coding practice is most effective in preventing SQL injection vulnerabilities?

   • AEncoding output before displaying it
   • BUsing parameterized queries or prepared statements
   • CDisabling error messages in production
   • DUsing a web application firewall (WAF)
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is developing a mobile banking app that will handle sensitive financial data. The project is behind schedule, and the product owner wants to skip security requirements to meet the deadline. As a security tester, what is the most appropriate action to support vulnerability avoidance?

   • ARefuse to participate in the project if security requirements are skipped.
   • BInsist that all security requirements be implemented before any feature is developed.
   • CAgree to skip the security requirements to meet the deadline, but document the risks.
   • DWork with the product owner to prioritize security requirements based on risk, and identify which can be deferred without introducing critical vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security tester identifies a flaw in an application's authentication logic that could allow an attacker to bypass login. How should this flaw be classified?

   • AA threat
   • BA risk
   • CA countermeasure
   • DA vulnerability
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software team is using an agile methodology with two-week sprints. They want to integrate security testing early to avoid vulnerabilities. Which practice best fits this goal?

   • AHiring an external security consultant to audit the application once a year.
   • BConducting a security review of the code only when a new feature is completed.
   • CRunning static application security testing (SAST) as part of the continuous integration pipeline on every commit.
   • DPerforming a full penetration test at the end of each release cycle.
   Reveal Solution Discussion Select an answer first