Mandatory Application CT-STE Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A security test team is planning a penetration test for a client that must comply with both PCI DSS and ISO/IEC 27001. The client's environment includes a cardholder data environment (CDE) and a separate corporate network. The team lead must create a test plan that satisfies both standards while minimizing disruption to business operations. Which approach is most appropriate?

   • ATest the entire corporate network to ensure comprehensive coverage for both standards.
   • BDefine the test scope to include the CDE and any systems that could impact its security, and schedule the test during a maintenance window to minimize disruption.
   • CUse only automated scanning tools to save time and reduce manual effort.
   • DConduct the test without prior notification to avoid alerting potential attackers.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is traceability important when documenting security test activities?

   • AIt ensures that all testers use the same testing tools
   • BIt allows test results to be traced back to specific requirements and test cases
   • CIt guarantees that no security vulnerabilities are missed
   • DIt helps in reducing the number of test cases needed
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following best describes the scope of mandatory application standards in security testing?

   • AThey apply only to applications that process financial data
   • BThey apply only to external security testers, not internal teams
   • CThey apply only to the execution phase of security testing
   • DThey apply to all phases of the security testing lifecycle, from planning through reporting
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security test team is documenting its activities for a client that must comply with both GDPR and ISO/IEC 27001. The client's data protection officer (DPO) and the ISO auditor will review the documentation. The team lead must ensure the documentation satisfies both sets of requirements. Which documentation approach is most appropriate?

   • AMaintain a single repository that includes test plans, evidence of execution, findings, remediation records, and a traceability matrix linking each activity to relevant GDPR and ISO/IEC 27001 requirements.
   • BStore test results only in the tester's personal notes to avoid unnecessary documentation overhead.
   • CUse a generic test template that does not reference specific systems or findings to keep the documentation simple.
   • DKeep separate documentation for GDPR and ISO/IEC 27001 to avoid confusion.
   Reveal Solution Discussion Select an answer first