Dynamic Security Test Tools CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of prioritizing vulnerabilities identified by dynamic security testing?

   • ATo ensure all vulnerabilities are fixed in the order they were discovered
   • BTo make the test report easier to read for management
   • CTo reduce the number of false positives in the report
   • DTo focus remediation efforts on the most critical risks first
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team must test a web application that is deployed in a containerized environment with ephemeral instances. The application uses a microservices architecture, and the team wants to perform dynamic security testing as part of the CI/CD pipeline. The testing must not significantly slow down the pipeline. Which approach best balances coverage and pipeline speed?

   • ADeploy a persistent staging environment and run a full scan once a month
   • BPerform a full manual penetration test on every build
   • CRun a lightweight vulnerability scanner against the deployed staging environment after each build
   • DRun a comprehensive fuzzing campaign on every build
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester is performing a penetration test on a web application. They want to identify vulnerabilities that require a deep understanding of the application's business logic, such as privilege escalation. Which technique is most appropriate?

   • AAutomated vulnerability scanning with a web scanner
   • BManual penetration testing with the use of an intercepting proxy
   • CFuzzing the application with random inputs
   • DRunning a network vulnerability scanner
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security tester needs to test a desktop application that runs on Windows and communicates with a backend server. The tester wants to analyze the application's runtime behavior, including memory usage and API calls. Which tool category is most appropriate?

   • AA web vulnerability scanner
   • BA runtime analysis tool
   • CAn intercepting proxy
   • DA network vulnerability scanner
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is reviewing a dynamic scan report that contains several findings. The analyst must decide which findings to remediate first. The report includes: a critical SQL injection in a public-facing login form, a high-severity XSS in an internal admin panel, and a medium-severity information disclosure in a public API. The team has limited development resources. What should the analyst prioritize?

   • AThe XSS in the internal admin panel
   • BThe information disclosure in the public API
   • CThe SQL injection in the public-facing login form
   • DAll findings simultaneously to avoid delays
   Reveal Solution Discussion Select an answer first