Mandatory Application CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services company must comply with PCI DSS. The security test team is planning the annual penetration test required by the standard. The compliance officer insists that the test scope must include all systems that store, process, or transmit cardholder data. The team lead wants to ensure the test plan is acceptable to the acquiring bank and the card brands. Which action is most important for the team lead to take?

   • APerform the penetration test using an automated scanning tool to reduce manual effort and speed up the process.
   • BDelay the test until the next software release to ensure the test reflects the latest production environment.
   • CInclude all systems in the corporate network in the test scope to avoid missing any cardholder data environment components.
   • DDefine the in-scope systems and obtain written sign-off from the compliance officer and the acquiring bank before testing begins.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security test engineer is assigned to a project for a government agency that must comply with the Federal Information Security Modernization Act (FISMA). The agency's security testing requirements are based on NIST guidelines. The engineer needs to understand the mandatory application of these standards. Which statement is correct?

   • ANIST guidelines are voluntary recommendations that agencies may choose to follow.
   • BFISMA requires agencies to implement security testing practices in accordance with NIST guidelines, which are mandatory for federal information systems.
   • CSecurity testing is optional under FISMA if the agency has a low-risk rating.
   • DFISMA applies only to systems that process classified information.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What documentation should be maintained to ensure traceability of security test activities?

   • AThe security test engineer's personal notes
   • BOnly the test cases and their expected results
   • CTest plans, test cases, test results, and defect reports
   • DOnly the final test report
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the reporting phase, what must a security test engineer do to comply with a mandatory standard?

   • AReport only the critical vulnerabilities to avoid overwhelming stakeholders
   • BInclude a summary of the test approach, findings, and recommendations in the final report
   • CVerbally communicate the results without a written report
   • DSubmit the report only to the development team
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security test team is planning a penetration test for a client that must comply with the Payment Card Industry Data Security Standard (PCI DSS). The client's network includes a cardholder data environment (CDE) and a separate corporate network. The team lead must ensure the test plan meets PCI DSS requirements. Which action is most appropriate?

   • ATest only the CDE because the corporate network is out of scope for PCI DSS.
   • BUse only automated scanning tools to save time and reduce manual effort.
   • CTest the entire corporate network to ensure comprehensive coverage.
   • DInclude the CDE and any systems that could impact the security of the CDE in the test scope.
   Reveal Solution Discussion Select an answer first