Pros and Cons of Leveraging Standards and Best Practices CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a well-known best practice for web application security testing that provides a comprehensive guide to testing techniques and is widely used by security testers?

   • ANIST SP 800-115
   • BISO/IEC 27002
   • CISO/IEC 29119
   • DOWASP Testing Guide
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A small startup with a limited budget is developing a mobile app and needs to conduct security testing. Which approach is most appropriate given the context?

   • AUse a formal standard like ISO/IEC 29119 for all testing activities.
   • BSkip security testing to save costs.
   • CImplement a full ISO/IEC 27001 certification process.
   • DAdopt a lightweight best practice like the OWASP Mobile Security Testing Guide.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security test engineer is considering using a formal standard for a project that has a very specific and unusual scope. The standard is comprehensive but may not fit the project's unique requirements. What is the primary advantage of using an informal best practice in this situation?

   • AIt requires more documentation and process overhead.
   • BIt can be adapted to the project's unique scope without the constraints of a formal standard.
   • CIt provides a higher level of authority and recognition.
   • DIt guarantees compliance with industry regulations.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security test engineer is working on a project that has a very tight deadline. The standard they follow requires a full suite of tests, but the team only has time to run a subset. The client is not aware of the standard and only cares about the most critical vulnerabilities being found. What is the best approach?

   • APrioritize the most critical tests based on risk and document the deviation from the standard.
   • BUse a different standard that requires fewer tests.
   • CRun the full suite of tests and accept that the project will be delayed.
   • DSkip the standard and run only the tests the team thinks are important.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is evaluating whether to adopt a formal standard for their testing process. They have a mature testing process that is already effective, but they are considering the standard to improve consistency and credibility. They are concerned about the overhead of implementing the standard. What is the most important factor to consider in this decision?

   • AThe adoption rate of the standard in the industry versus the team's preference.
   • BThe cost of the standard versus the cost of not having a standard.
   • CThe potential improvement in consistency and credibility versus the overhead of implementation.
   • DThe authority of the standard versus the flexibility of the current process.
   Reveal Solution Discussion Select an answer first