Mandatory Application CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security test engineer is joining a project for a client that must comply with the EU General Data Protection Regulation (GDPR). The client's security testing requirements are not yet defined. The engineer needs to understand the scope of mandatory application standards for this project. Which statement best describes the scope?

   • AGDPR mandates security testing of all systems that process personal data, but does not prescribe specific testing techniques.
   • BGDPR applies only to systems located within the European Union.
   • CGDPR requires penetration testing of all internet-facing systems at least quarterly.
   • DGDPR does not require security testing because it is a data protection regulation, not a security standard.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security test engineer is assigned to a project for a multinational company that must comply with both GDPR and PCI DSS. The company's systems process personal data and cardholder data. The engineer must plan security testing that satisfies both regulations. Which approach is most appropriate?

   • ADefine a test scope that includes all systems processing personal data and cardholder data, and apply the stricter of the two sets of requirements where they overlap.
   • BTest only systems that process cardholder data because they are the most critical.
   • CUse a single generic test plan that does not reference specific regulations to avoid conflicts.
   • DFocus only on PCI DSS requirements because they are more specific and detailed.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of mandatory application standards in security testing?

   • ATo provide a consistent baseline for security testing activities and ensure compliance with legal or contractual obligations
   • BTo focus exclusively on functional testing and ignore security-specific concerns
   • CTo replace the need for risk-based testing by providing a one-size-fits-all testing approach
   • DTo serve as a voluntary guideline that organizations can adopt if they choose
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization is preparing for a certification audit against ISO/IEC 27001. The security test team must demonstrate that its testing activities are aligned with the standard's requirements. The auditor has requested evidence of testing. Which evidence is most appropriate to provide?

   • AA list of all vulnerabilities discovered in the past year without any context.
   • BA verbal explanation of the testing process during the audit interview.
   • CA traceability matrix linking each test activity to the relevant ISO/IEC 27001 control, along with test reports and remediation records.
   • DA summary slide deck highlighting the key findings from the latest penetration test.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is preparing for an external audit to verify conformance to ISO/IEC 27001. The security test team must demonstrate that its testing activities are aligned with the standard's requirements. Which action best supports the audit preparation?

   • AConduct a new penetration test immediately before the audit to show recent activity.
   • BAsk the auditor to sign a non-disclosure agreement before sharing any test results.
   • CProvide the auditor with a traceability matrix linking each security test activity to the relevant ISO/IEC 27001 control.
   • DSummarize the test results in a single slide to keep the audit presentation concise.
   Reveal Solution Discussion Select an answer first