Avoid Vulnerability CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary goal of threat modeling in the context of vulnerability avoidance?

   • ATo select the best security testing tools
   • BTo identify potential threats and design mitigations before implementation
   • CTo test the system after deployment for vulnerabilities
   • DTo create a list of all possible vulnerabilities in existing software
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security architect is leading a threat modeling workshop for a new payment processing system. The system will handle cardholder data and must comply with PCI DSS. During the workshop, the team identifies that the system will accept input from a public-facing web form. Which threat modeling output is most directly useful for avoiding vulnerabilities in the input handling component?

   • AA set of abuse cases that describe how an attacker might misuse the web form to inject malicious payloads.
   • BA data flow diagram showing the path of input from the web form to the backend database, with trust boundaries marked.
   • CA risk register that assigns a risk score to each identified threat and lists mitigation owners.
   • DA list of all possible attack vectors against the system, ranked by likelihood and impact.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester discovers a buffer overflow vulnerability in a legacy C++ module. The module is scheduled for replacement in six months, but it is still in production. What is the most appropriate way to document this vulnerability to support its remediation?

   • AAdd a code comment in the module explaining the vulnerability and suggesting a fix.
   • BInclude the vulnerability in the final test report with a note that it is a known issue and will be fixed in the next major release.
   • CCreate a detailed vulnerability report that includes the affected component, the exact conditions that trigger the overflow, the potential impact, and recommended mitigation steps.
   • DReport the vulnerability verbally to the development lead and rely on them to communicate it to the team.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key characteristic of an effective vulnerability report?

   • AIt lists only the vulnerability name without explanation
   • BIt is written in highly technical jargon to impress experts
   • CIt focuses only on the technical details without context
   • DIt includes clear, actionable steps to reproduce and remediate the issue
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup is developing a new web application and wants to integrate security testing early in the development process. They have a small team and limited budget. Which approach is most practical for them?

   • AHiring a full-time security engineer to perform manual security testing.
   • BUsing free or low-cost SAST tools in the CI pipeline and providing developers with secure coding training.
   • CRelying on the developers to manually review each other's code for security issues.
   • DWaiting until the application is feature-complete before performing a single penetration test.
   Reveal Solution Discussion Select an answer first