Mandatory Application CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security test team is documenting its activities for a client that must comply with the Sarbanes-Oxley Act (SOX). The client's internal audit team will review the documentation to verify that security testing supports financial reporting integrity. Which documentation practice is most aligned with SOX requirements?

   • AShare test reports with all employees to promote transparency and collaboration.
   • BStore test results in the tester's personal email to ensure quick access during the audit.
   • CUse a shared spreadsheet that anyone can edit to simplify documentation updates.
   • DMaintain evidence of test execution, findings, and remediation in a controlled repository with access restricted to authorized personnel.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which regulatory framework is specifically designed to protect personal data and includes requirements for security testing of systems that process such data?

   • AISO/IEC 27001
   • BPCI DSS
   • COWASP Top 10
   • DGDPR
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security test engineer is joining a project for a client that must comply with the Sarbanes-Oxley Act (SOX). The client's security testing requirements are not yet defined. The engineer needs to understand the scope of mandatory application standards for this project. Which statement best describes the scope?

   • ASOX does not require security testing because it is a financial reporting regulation, not a security standard.
   • BSOX applies only to systems that process credit card transactions.
   • CSOX mandates security testing of all systems that could affect financial reporting, but does not prescribe specific testing techniques.
   • DSOX requires penetration testing of all internet-facing systems at least annually.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   During the test planning phase, how should a security test engineer apply a mandatory standard?

   • ABy documenting the results after the test is complete
   • BBy executing the test cases exactly as specified in the standard
   • CBy skipping the planning phase and focusing only on execution
   • DBy defining the test scope and objectives to align with the standard's requirements
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary role of a security test engineer during an audit that verifies conformance to mandatory standards?

   • ATo perform the audit independently and report findings to management
   • BTo fix any non-conformities found during the audit immediately
   • CTo ensure that the audit does not disrupt the testing schedule
   • DTo provide evidence that the security testing activities were performed in accordance with the standard
   Reveal Solution Discussion Select an answer first