Recertification Testing and Reconciliation Testing CT-STE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A multinational corporation has a critical application that was certified against internal security standards. The application is scheduled for a major upgrade that will change the authentication mechanism and introduce a new API. The upgrade is planned for a maintenance window that is only 4 hours long. The security team must ensure the application still meets its certification criteria after the upgrade, but the full original certification test suite takes 12 hours to execute. The team has limited resources and cannot extend the maintenance window. What is the most appropriate approach?

   • APerform a full recertification testing after the maintenance window, even if it takes 12 hours
   • BPerform reconciliation testing to compare the configuration after the upgrade to the baseline
   • CSkip recertification testing because the upgrade is minor
   • DPerform a scoped recertification testing that focuses on the authentication and API changes, and schedule a full recertification later
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare organization's patient portal was certified against security standards two years ago. The organization's compliance policy requires recertification every two years, but the portal has had no significant changes. The security team is planning the recertification. What is the primary trigger for this recertification testing?

   • AA new regulatory requirement that was introduced
   • BA security incident that affected the portal
   • CTime-based recertification required by the compliance policy
   • DA major change to the patient portal's authentication system
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team needs to plan reconciliation testing for a set of servers after a patch deployment. The team wants to ensure that the servers' configurations still match the documented security baseline. Which step should be performed first in the planning phase?

   • ASchedule the reconciliation testing for a maintenance window
   • BCollect evidence of the current configuration from all servers
   • CDefine pass criteria for the reconciliation
   • DIdentify the documented baseline that the servers should conform to
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the first step in planning recertification testing?

   • ARemediate any identified vulnerabilities
   • BDefine the scope of the recertification effort
   • CExecute the security tests
   • DReport the findings to stakeholders
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   After a security incident, a security team is executing reconciliation testing on a compromised server. The team has the documented baseline for the server's configuration. What should the team do during the execution phase?

   • AAnalyze the incident logs to determine the root cause
   • BRestore the server from a backup and then compare configurations
   • CCompare the current configuration of the server against the documented baseline
   • DRe-run the security tests from the original certification
   Reveal Solution Discussion Select an answer first