Mandatory Application CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security test team is planning a test for a client that must comply with the Health Insurance Portability and Accountability Act (HIPAA). The client's environment includes a mix of cloud and on-premises systems that process protected health information (PHI). The team lead must ensure the test plan aligns with HIPAA requirements. Which action is most appropriate?

   • ATest only the on-premises systems because cloud systems are managed by the cloud provider.
   • BExclude systems that are not directly connected to the internet from the test scope.
   • CTest only the cloud systems because they are more likely to be targeted by attackers.
   • DInclude all systems that create, receive, maintain, or transmit PHI in the test scope, regardless of location.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization is subject to HIPAA and must demonstrate that its security testing activities are aligned with the Security Rule's requirements. The security test manager is updating the test process documentation. Which documentation practice best supports HIPAA compliance?

   • AUse a generic test template that does not reference specific systems or findings to keep the documentation simple.
   • BDocument the test methodology, evidence of execution, and remediation actions in a format that can be presented during an audit.
   • CStore test results only in the tester's personal notes to avoid unnecessary documentation overhead.
   • DKeep test reports in a shared folder accessible to all employees to promote transparency.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security test team is documenting its activities for a client that must comply with the General Data Protection Regulation (GDPR). The client's data protection officer (DPO) will review the documentation to verify that security testing supports the security of processing. Which documentation practice is most aligned with GDPR requirements?

   • AUse a generic test template that does not reference specific systems or findings to keep the documentation simple.
   • BKeep test results in a shared drive accessible to all employees to promote transparency.
   • CStore test results only in the tester's personal notes to avoid unnecessary documentation overhead.
   • DMaintain records of test activities, findings, and remediation actions, including dates and responsible personnel.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a compliance framework that mandates security testing for organizations that handle credit card data?

   • AHIPAA
   • BPCI DSS
   • CISO/IEC 27001
   • DSOX
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a key activity to prepare for an audit of security testing conformance?

   • AEnsuring that all test documentation is complete, accurate, and easily accessible
   • BConducting a new security test just before the audit
   • CDeleting outdated test results to avoid confusion
   • DWaiting until the audit starts to gather documentation
   Reveal Solution Discussion Select an answer first