Information Sensitivity and Security Testing CT-STE Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   Which of the following best describes the purpose of classifying information sensitivity levels in an organization?

   • ATo determine the exact monetary value of each information asset for insurance purposes
   • BTo prioritize security testing efforts based on the potential impact of unauthorized disclosure or modification
   • CTo simplify access control by giving all employees the same level of access to all information
   • DTo assign ownership of each information asset to a specific business unit
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security test engineer is assigned to test a new web application that handles sensitive employee data. The test environment is a clone of production and contains real data. The engineer needs to run a series of automated scans that may generate false positives and could potentially modify data. What is the most appropriate safeguard to implement?

   • ARun the scans against a separate test instance with synthetic data.
   • BRun the scans during off-hours and monitor for any anomalies.
   • CRun the scans with a limited set of test cases to minimize impact.
   • DRun the scans in read-only mode to prevent any data modification.
   Reveal Solution Discussion Select an answer first