Hide Vulnerability CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes the role of stakeholder coordination in responsible disclosure?

   • ACoordination is only needed with the tester's own management, not external parties
   • BCoordination is unnecessary if the vulnerability is low severity
   • CCoordination involves working with the vendor and other affected parties to agree on a timeline for public disclosure
   • DCoordination is primarily the responsibility of the vendor, not the tester
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A junior tester on a team finds a vulnerability in a client's system. The tester is unsure if the finding is a true positive or a false positive. What is the most appropriate action for the tester to take?

   • AImmediately report it to the vendor as a zero-day vulnerability.
   • BInclude it in the final report as a confirmed vulnerability to be thorough.
   • CMention it in the report as a 'potential finding' that requires further verification, and discuss it with a senior team member.
   • DOmit it from the report to avoid looking unskilled in front of the client.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is writing the final report for a client. The report contains a finding that is technically accurate but the tester is concerned that the client's management might not understand the technical jargon. What is the best way to present the finding in the report?

   • AProvide a technical description for the IT team and a separate, non-technical executive summary for management.
   • BUse only technical terms and acronyms, as the report is for the IT department.
   • COmit the technical details and only provide a high-level summary.
   • DWrite the report in a highly technical way and assume management will ask questions if they need clarification.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is performing a test for a client and discovers a vulnerability in a third-party API the client uses. The API vendor does not have a public bug bounty program or a dedicated security contact. What is the most appropriate reporting channel for the tester to use?

   • AThe tester's personal blog, to document the discovery and share it with the security community.
   • BA public vulnerability database, such as the CVE database, to ensure the issue is publicly tracked.
   • CThe API vendor's general support email address, as it is the only public contact available.
   • DThe tester's own client, so they can decide how to handle the vulnerability with the vendor.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to report vulnerabilities in a structured format rather than only through informal verbal communication?

   • AA structured report guarantees that the vulnerability will be fixed immediately
   • BA structured report ensures that the information is complete, reproducible, and actionable for the recipients
   • CA structured report is required by law in all jurisdictions
   • DA structured report prevents the vulnerability from being exploited by anyone
   Reveal Solution Discussion Select an answer first