Pros and Cons of Leveraging Standards and Best Practices CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A security testing team is considering adopting a best practice that is known to be effective but requires significant training. What is a potential trade-off they should evaluate?

   • AThe best practice will require the team to abandon all existing tools.
   • BThe best practice will make the team less efficient in the long run.
   • CThe training cost may be offset by improved testing effectiveness and reduced errors.
   • DThe best practice will definitely reduce the number of vulnerabilities found.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security test engineer is choosing between a formal standard and an informal best practice for a new testing project. The project has a tight deadline and the team is experienced. The client does not require a specific standard. What is the primary advantage of using an informal best practice in this context?

   • AIt requires more documentation and process overhead.
   • BIt offers more flexibility and can be adapted quickly to the project's needs.
   • CIt guarantees compliance with regulatory requirements.
   • DIt provides a higher level of authority and recognition.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A small software company develops a customer-facing web application. They have a small security team and a tight release schedule. They want to adopt a security testing standard to improve consistency but are concerned about overhead. Which approach best balances these concerns?

   • AUse only informal best practices from online forums to avoid any formal process overhead.
   • BAdopt a lightweight, risk-based testing framework and tailor it to the application's specific threats and release cadence.
   • CImplement the full set of controls from a comprehensive standard to ensure maximum coverage, regardless of the time required.
   • DSkip standards entirely and rely on the team's experience to guide testing, as they know the application best.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In terms of flexibility, how do best practices typically compare to formal standards?

   • AFormal standards are more flexible because they are updated frequently.
   • BBest practices are less flexible because they are based on proven methods.
   • CBest practices are usually more flexible and can be adapted to specific contexts.
   • DBoth are equally flexible and can be adapted without any constraints.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security test engineer is working on a project that involves a legacy system with known vulnerabilities. The standard they follow requires a specific set of tests, but the legacy system cannot support some of them. The team has a limited budget and timeline. What is the best course of action?

   • ATailor the standard to the legacy system's constraints, documenting any deviations and focusing on the most critical tests.
   • BAbandon the standard and use ad-hoc testing based on the engineer's experience.
   • CApply the standard fully, even if it means delaying the project to complete all required tests.
   • DUse a different standard that is less rigorous and easier to implement.
   Reveal Solution Discussion Select an answer first