Recertification Testing and Reconciliation Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is planning recertification testing for a system that has had several minor updates over the past year. The team has limited budget and wants to minimize the cost of recertification while still ensuring the system meets its security requirements. The original certification included a comprehensive test suite that took two weeks to execute. What is the most cost-effective approach that still provides reasonable assurance?

   • APerform a risk-based scoping of the recertification, focusing on the areas affected by the updates
   • BSkip recertification testing because the updates were minor
   • CRe-run the entire original test suite to ensure complete coverage
   • DPerform reconciliation testing instead of recertification testing
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is planning reconciliation testing for a fleet of database servers after a recent security incident. The team has identified the documented baseline for the servers. What should the team do next in the planning phase?

   • AImmediately compare the current configurations to the baseline
   • BDefine pass criteria for the reconciliation, such as zero deviations from the baseline
   • CReport the findings to management
   • DCollect evidence of the current configuration from all servers
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which situation would most likely require recertification testing?

   • AThe system's uptime is monitored
   • BA routine software update is applied to the operating system
   • CA new compliance regulation is introduced that affects the system
   • DA user reports a typo in a help document
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team completed recertification testing on a legacy system. The testing revealed that the system no longer meets several security requirements due to outdated encryption protocols. The system is critical to operations and cannot be taken offline for a major upgrade. What should the team do next?

   • AReport the findings and recommend remediation, such as applying compensating controls or scheduling a re-certification after fixes
   • BIgnore the findings because the system is critical and cannot be changed
   • CRe-run the tests until they pass
   • DImmediately revoke the system's certification and shut it down
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the main objective of reconciliation testing?

   • ATo test the effectiveness of security controls against real attacks
   • BTo verify that security controls and configurations are consistent with the intended baseline
   • CTo confirm that a system still meets security requirements after a change
   • DTo ensure that all users have the correct access rights
   Reveal Solution Discussion Select an answer first