Grey-Box Security Test Tools CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A security team needs to select a grey-box tool for a web application built with Python and React. Which factor is most important to consider first?

   • AThe tool's support for Python and JavaScript technologies
   • BThe color of the tool's user interface
   • CThe tool's popularity on social media
   • DThe tool's ability to generate reports in PDF format
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A grey-box test of a web application found a SQL injection vulnerability in a search feature. The tester has the source code and can see the vulnerable query. What is the most appropriate way to report this finding to the development team?

   • AIgnore the finding because it was only found in a test environment
   • BReport the issue to the system administrator to patch the database
   • CProvide the vulnerable code snippet, a proof-of-concept request, and a recommended fix (e.g., parameterized queries)
   • DOnly state that SQL injection was found in the search feature
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When selecting a grey-box security test tool, which of the following is a key resource constraint to consider?

   • AThe tool's license cost and the team's budget
   • BThe tool's graphical user interface
   • CThe tool's version number
   • DThe tool's ability to run on any operating system
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement best describes how grey-box testing combines black-box and white-box approaches?

   • AIt requires full source code access to perform line-by-line code review for every function
   • BIt uses only automated tools to scan for known vulnerabilities without any manual analysis
   • CIt tests the application from the outside while using some internal information to guide test design and execution
   • DIt focuses exclusively on testing the user interface without any consideration of backend logic
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A grey-box fuzzer is testing a web application's file upload feature. The fuzzer is configured with a dictionary of common file names and payloads. However, the fuzzer is not finding any vulnerabilities. The tester has the source code and knows the upload validation logic. What is the most effective way to improve the fuzzer's effectiveness?

   • AAnalyze the upload validation code to understand the checks and craft inputs that bypass them
   • BDisable the fuzzer's logging to improve performance
   • CUse a different fuzzer that is not coverage-guided
   • DIncrease the number of random inputs generated per second
   Reveal Solution Discussion Select an answer first