Pros and Cons of Leveraging Standards and Best Practices CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A government agency is required to follow a formal security testing standard to comply with regulations. Which of the following is the most appropriate action?

   • ADevelop a custom testing process without referencing any standard.
   • BAdopt a formal standard such as NIST SP 800-115 and tailor it to the agency's needs.
   • CUse a general software testing standard like ISO/IEC 29119.
   • DUse a best practice like the OWASP Testing Guide instead of a formal standard.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a key difference between a formal standard and a best practice in security testing?

   • AFormal standards are developed by industry experts, while best practices are developed by government agencies.
   • BFormal standards are typically developed by recognized standards bodies and have a formal approval process, while best practices are often community-driven and more flexible.
   • CFormal standards are always more effective than best practices.
   • DFormal standards are mandatory, while best practices are optional.
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A security test engineer is working for a government contractor that must comply with federal security requirements. They need to select a standard that provides a comprehensive set of security controls for information systems. Which standard is most appropriate?

   • AISO 27001
   • BOWASP Testing Guide
   • CPCI DSS
   • DNIST SP 800-53
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security test engineer is working on a project that has unique requirements not covered by the standard they usually follow. They decide to deviate from the standard to address these requirements. What is the primary risk of this deviation?

   • AThe deviation may lead to inconsistent testing practices across projects.
   • BThe deviation will make the testing process less efficient.
   • CThe deviation will increase the cost of testing significantly.
   • DThe deviation will definitely cause security vulnerabilities to be missed.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a potential drawback of strictly following a security testing standard without considering the project context?

   • AThe standard will increase the number of vulnerabilities found.
   • BThe standard will always be too complex to implement.
   • CThe standard will reduce the quality of testing.
   • DThe standard may not be applicable to all types of security testing, leading to irrelevant activities.
   Reveal Solution Discussion Select an answer first