Black-Box Security Test Tools CT-STE Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   Which characteristic is typical of black-box security test tools?

   • AThey guarantee the absence of all vulnerabilities if no issues are found
   • BThey test the system from an external viewpoint, simulating an attacker's perspective
   • CThey require access to the application's source code to function
   • DThey are only used during the requirements phase of the SDLC
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A vulnerability scanner reports a critical SQL injection vulnerability in a login form. The security team manually tests the same form with the same payload and the application returns a generic error page. The team has limited time and must decide whether to report the finding to management. What is the most appropriate next step?

   • AReport the finding as a confirmed critical vulnerability
   • BRe-run the scanner with default settings to confirm
   • CIgnore the finding because the manual test did not reproduce it
   • DManually verify the finding with a controlled payload that produces a distinct response
   Reveal Solution Discussion Select an answer first