Dynamic Security Test Tools CT-STE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team is planning to run a dynamic scan on a critical application. They are concerned about the scan's impact on the application's performance. What is the best way to mitigate this risk?

   • ADisable the web application firewall during the scan
   • BRun the scan during peak hours to test under load
   • CRun the scan in a staging environment that mirrors production
   • DUse a scanner with a smaller vulnerability database
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After running an authenticated vulnerability scan against a staging environment, the scanner reports a 'critical' SQL injection in a search feature. The development team reviews the code and finds that the query uses parameterized statements. What is the most appropriate next step?

   • AMark the finding as a false positive and request a re-scan with adjusted rules
   • BImmediately patch the search feature and schedule an emergency release
   • CIgnore the finding because the scan was run against staging, not production
   • DTreat the finding as confirmed and add it to the risk register
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which technique involves sending malformed or unexpected inputs to an application to trigger failures or security vulnerabilities?

   • AFuzzing
   • BRuntime analysis
   • CPenetration testing
   • DStatic code review
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is selecting a dynamic testing tool for a legacy application that uses a proprietary protocol over TCP. The tool must be able to interact with the protocol. Which tool characteristic is most important?

   • AThe ability to scan mobile applications
   • BSupport for custom protocol scripting or extension
   • CA large database of known web vulnerabilities
   • DIntegration with CI/CD pipelines
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is deploying a new mobile application that communicates with a backend API. The security team wants to test the API for authentication and authorization flaws. Which tool category is most suitable?

   • AA network vulnerability scanner that checks for open ports and services
   • BA mobile application scanner that tests the app's local storage and permissions
   • CAn API security testing tool that can automate requests and analyze responses
   • DA fuzzer that sends random data to the API endpoints
   Reveal Solution Discussion Select an answer first