Information Sensitivity and Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An organization's data handling policy requires that all test data containing personal information be anonymized before use in non-production environments. What is the main purpose of this requirement?

   • ATo comply with data protection regulations and minimize the risk of exposing personal data during testing
   • BTo ensure that test results are reproducible across different environments
   • CTo make test data more realistic for performance testing
   • DTo reduce the storage space required for test databases
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security test engineer is about to perform a vulnerability scan on a system that processes credit card data. The organization is subject to PCI DSS. What must the engineer ensure before starting the scan?

   • AThe scan is scheduled during off-peak hours to minimize impact.
   • BThe scan is approved by management and the scope is limited to systems in the cardholder data environment.
   • CThe scan is performed from an external network to simulate an attacker.
   • DThe scan uses only passive techniques to avoid disrupting operations.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security test engineer is developing a test plan for a system that contains a mix of public marketing data and confidential financial records. The engineer needs to prioritize testing efforts. How should the engineer determine which areas to test first?

   • APrioritize testing of the financial records because they are classified as confidential.
   • BFocus on the public marketing data because it is more visible to users.
   • CTest the financial records only after the marketing data is fully tested.
   • DTest all areas equally to ensure comprehensive coverage.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security test engineer is working with a client that is subject to GDPR. The client wants to test a new feature that processes personal data of EU citizens. The test environment is in a non-EU country. What must the engineer consider?

   • AThe test can be done without restrictions because it is for security testing purposes.
   • BThe test can proceed as long as the data is encrypted.
   • CThe test should be performed only on synthetic data to avoid GDPR issues.
   • DThe test must ensure that any transfer of personal data to the test environment complies with GDPR transfer rules.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security test engineer is tasked with testing a system that contains both classified government data and unclassified data. The test environment is on a network that is not approved for classified data. What is the most critical action the engineer must take?

   • AEnsure that the test environment is isolated from the production network.
   • BObtain approval from the data owner to test the classified data in the test environment.
   • CSeparate the classified data from the unclassified data and test only the unclassified data in the current environment.
   • DProceed with testing as long as the test team has security clearances.
   Reveal Solution Discussion Select an answer first