Information Sensitivity and Security Testing CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security test engineer is leading a red team exercise for a large organization. The exercise will involve attempting to access sensitive data through various attack vectors. The organization has a strict rule that the exercise must not cause any service disruption. What is the most important constraint to communicate to the red team?

   • AThey must avoid using any techniques that could crash the system.
   • BThey must not access or exfiltrate any real sensitive data.
   • CThey must operate within the defined scope and rules of engagement.
   • DThey must report any findings immediately to the incident response team.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security test engineer is planning a test that involves social engineering to assess employee awareness. The test will use realistic phishing emails that may trick employees into revealing credentials. The organization has a strict policy against collecting or storing real credentials. What is the best way to conduct this test?

   • AUse a third-party service that stores credentials securely.
   • BAsk employees to voluntarily provide their credentials for the test.
   • CCapture credentials but immediately delete them after the test.
   • DUse a simulated phishing campaign that redirects to a training page instead of capturing credentials.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During a security test, a tester encounters a data field labeled 'Restricted' in the system's data dictionary. According to a typical information sensitivity classification scheme, what does this label primarily indicate?

   • AThe data is only accessible to system administrators
   • BUnauthorized disclosure of this data could cause serious harm to the organization or individuals
   • CThe data is encrypted at rest and in transit by default
   • DThe data is publicly available and requires no special protection
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security test engineer is working with a client that has a data retention policy requiring that test data be deleted after the test is complete. The engineer has used a cloud-based testing tool that stores data in multiple regions. What should the engineer do to comply with the policy?

   • AAsk the client to delete the data manually.
   • BIgnore the policy because cloud providers handle data deletion.
   • CDelete the data from the tool's primary region only.
   • DEnsure that the tool's data deletion process covers all regions where data is stored.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security test engineer is planning a penetration test for a healthcare organization's patient portal. The test will involve live production data. The organization has classified patient records as 'Confidential' and requires that any test data be anonymized. However, the test team needs realistic data to validate access control flaws. What should the engineer do?

   • AUse a subset of real patient data but restrict access to the test team and encrypt the test environment.
   • BTest directly on production with read-only access to avoid data duplication.
   • CGenerate synthetic data that mimics the structure and distribution of real patient data, and use it for testing.
   • DRequest a waiver from the compliance officer to use real data for the test.
   Reveal Solution Discussion Select an answer first