Considerations for Selecting Tools CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company uses a mix of on-premises and cloud-based applications. They are evaluating a new vulnerability management platform. The platform must integrate with their existing SIEM and ticketing system. The vendor offers a cloud-hosted platform and an on-premises appliance. What is the most important consideration when deciding between the two deployment options?

   • AThe cloud-hosted platform is likely to be less expensive and require less maintenance.
   • BThe ability of both options to integrate with the existing SIEM and ticketing system.
   • CThe on-premises appliance may provide better performance for scanning internal assets.
   • DThe vendor's reputation and market share in the vulnerability management space.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which activity is part of a systematic tool evaluation process?

   • ARunning a proof of concept on a representative test application
   • BChoosing the tool based on the vendor's marketing materials
   • CDeferring the decision to the development team
   • DSelecting the tool that is the most popular in the industry
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A small development team builds a customer-facing web application using a JavaScript framework. The team has no dedicated security staff, and the budget for security tooling is limited. They need to identify common web vulnerabilities (e.g., XSS, SQL injection) in their code before each release. Which tool selection approach best fits their constraints?

   • ASelect a commercial DAST scanner with the most comprehensive vulnerability database, regardless of cost.
   • BChoose an open-source SAST tool that integrates with their CI/CD pipeline and has an active community for support.
   • CUse a free online vulnerability scanner that requires manual upload of the entire codebase after each commit.
   • DSelect a commercial SAST tool that requires extensive training and manual configuration to be effective.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does a subscription-based licensing model typically affect the cost of a security test tool compared to a perpetual license?

   • AIt requires a large upfront payment and no ongoing fees
   • BIt spreads the cost over time and often includes maintenance and updates
   • CIt always results in a lower total cost over five years
   • DIt eliminates the need for vendor support
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is evaluating a new DAST tool. The tool is highly effective at finding vulnerabilities but is very expensive. The team has a limited budget but a strong internal capability to write custom scripts. They also have a requirement to scan a legacy application that uses a proprietary protocol. What is the most balanced decision?

   • ASelect the expensive DAST tool and negotiate a payment plan.
   • BDevelop a custom in-house scanner using the team's scripting skills.
   • CSelect the expensive DAST tool, as its effectiveness justifies the cost.
   • DUse a less expensive, open-source DAST tool and supplement it with custom scripts for the proprietary protocol.
   Reveal Solution Discussion Select an answer first