Recertification Testing and Reconciliation Testing CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a critical input for planning reconciliation testing?

   • AThe user access list
   • BThe system's performance metrics
   • CThe documented security baseline
   • DThe latest vulnerability scan results
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company recently deployed a critical security patch to its web servers. The patch modified several configuration files. The security team wants to ensure that the patch did not introduce any unintended configuration changes that deviate from the security baseline. Which testing activity should the team perform?

   • APerformance testing to ensure the patch did not degrade server performance
   • BRecertification testing to revalidate the security certification of the servers
   • CVulnerability scanning to identify new vulnerabilities introduced by the patch
   • DReconciliation testing to compare the current configuration against the baseline
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key difference between recertification testing and reconciliation testing?

   • ARecertification is a one-time activity; reconciliation is performed continuously
   • BRecertification focuses on configuration; reconciliation focuses on security requirements
   • CRecertification confirms the system meets security requirements; reconciliation verifies configuration consistency with a baseline
   • DRecertification is performed only after incidents; reconciliation is performed only before changes
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team performed reconciliation testing on a set of servers and found that several servers have a firewall rule that deviates from the baseline. The deviation was unintentional and does not pose an immediate security risk. What should the team do as a follow-up action?

   • AReport the deviation and remediate by restoring the correct firewall rule
   • BPerform a full recertification of the servers
   • CUpdate the baseline to match the current configuration
   • DIgnore the deviation because it does not pose an immediate risk
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is executing recertification testing on a legacy application that was certified two years ago. The application has had no changes, but the team wants to ensure it still meets the security requirements. During execution, the team re-runs the original security tests. What should the team do with the results?

   • AAutomatically re-certify the system if all tests pass
   • BEvaluate the results against the original certification criteria to determine if the system still passes
   • CCompare the results to the baseline configuration
   • DDocument the results and archive them without further action
   Reveal Solution Discussion Select an answer first