Identifying and Analyzing Vulnerabilities CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During a security test, a tester observes that the application returns detailed stack traces in HTTP error responses. Which activity does this observation directly support?

   • AVulnerability identification
   • BRisk assessment
   • CEvidence collection
   • DVulnerability analysis
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You are testing a web application and have discovered a critical vulnerability. You have captured the proof-of-concept (PoC) request and response in your proxy tool. However, the response contains a session token for the test account you used. What is the most appropriate way to handle this evidence for the final report?

   • AInclude the full, unredacted request and response in the report, as it is important to show the exact data returned by the server.
   • BExclude the response from the report and only include the request, as the request is the most important part of the evidence.
   • CInvalidate the session token and then include the full, unredacted response in the report.
   • DRedact the session token from the response before including it in the report, and note in the evidence that the token was redacted for security reasons.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   Your security assessment of a healthcare application has identified two critical findings. Finding A is a SQL injection in the patient portal that could expose Protected Health Information (PHI). Finding B is a remote code execution (RCE) vulnerability in a legacy internal reporting tool that is not directly accessible from the internet. The client has limited resources and can only fix one vulnerability this quarter. Which vulnerability should you recommend they fix first?

   • AFinding A, because the direct exposure of PHI has immediate regulatory and reputational consequences, and the likelihood of exploitation is higher due to its internet-facing nature.
   • BFinding B, because RCE always has a higher impact than SQL injection, as it can lead to full system compromise.
   • CFinding B, because fixing an RCE vulnerability is a more complex task and should be prioritized to allow more time for remediation.
   • DFinding A, because SQL injection is a more common vulnerability and therefore more likely to be targeted by automated tools.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A tester has identified two vulnerabilities: one with high likelihood and low impact, and another with low likelihood and high impact. Which activity would help determine which vulnerability to address first?

   • AVulnerability classification
   • BEvidence collection
   • CVulnerability identification
   • DRisk assessment
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You are documenting a complex business logic flaw in an e-commerce application that allows a user to apply a discount code multiple times. You have a series of screenshots showing the steps. What is the most effective way to present this evidence in the vulnerability report?

   • ACreate a single, annotated screenshot that shows the final state of the cart with the discount applied multiple times.
   • BAttach all screenshots in a single appendix at the end of the report, with no further explanation.
   • CDescribe the steps in text only and mention that screenshots are available upon request.
   • DEmbed the screenshots within the 'Reproduction Steps' section, with a brief caption for each one explaining the action taken.
   Reveal Solution Discussion Select an answer first