Dynamic Security Test Tools CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common limitation of dynamic security testing tools?

   • AThey cannot detect vulnerabilities that require specific user interactions or complex business logic
   • BThey are unable to test applications that are not yet deployed
   • CThey require access to the source code to function
   • DThey always produce false positives
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of dynamic security testing?

   • ATo review the design and architecture of an application to identify security weaknesses
   • BTo analyze source code for potential security flaws without executing the application
   • CTo evaluate the security of an application by executing it and observing its behavior in a runtime environment
   • DTo scan configuration files and deployment scripts for insecure settings
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement correctly distinguishes dynamic security testing from static analysis?

   • ADynamic testing can only detect vulnerabilities introduced during compilation, while static analysis detects runtime errors
   • BDynamic testing is automated, while static analysis is always performed manually
   • CDynamic testing requires the application to be running, whereas static analysis examines the code without execution
   • DDynamic testing is performed only during the design phase, while static analysis is performed during testing
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When interpreting the output of a dynamic security test tool, what does a 'false positive' refer to?

   • AA reported vulnerability that does not actually exist in the application
   • BA vulnerability that was fixed during the test
   • CA real vulnerability that the tool failed to detect
   • DA vulnerability that is present but not exploitable
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is evaluating a dynamic scanner for a high-traffic e-commerce application. The scanner is known to generate a high number of false positives. The team has limited resources for manual verification. Which strategy is most effective to manage the false positive rate?

   • AUse the scanner only on non-critical applications
   • BConfigure the scanner with custom rules and a baseline of known false positives
   • CRun the scanner at the highest intensity to catch all vulnerabilities
   • DIgnore all findings that are not confirmed by another tool
   Reveal Solution Discussion Select an answer first