Security Audits and Security Testing CT-STE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization is planning a security audit of its cloud infrastructure. The audit sponsor wants to ensure the audit focuses on the most critical systems and does not waste resources on low-risk areas. What should the audit team define FIRST to achieve this?

   • AThe audit report format, including the executive summary and detailed findings sections
   • BThe audit scope, including the specific systems, locations, and criteria to be evaluated
   • CThe list of audit evidence collection tools, such as configuration scanners and log analyzers
   • DThe follow-up action plan, including who will remediate any identified findings
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After completing a security audit, the audit team issues a report that identifies several high-risk findings. The report is delivered to management, but no follow-up actions are assigned. What is the MOST likely consequence of this omission?

   • AThe audit report will be considered invalid and must be redone
   • BThe findings will automatically be resolved by the next scheduled audit
   • CThe audit team will be required to perform the remediation themselves
   • DThe identified risks will remain unaddressed, and the audit will have limited impact
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security audit has been completed, and the final report has been issued. The report includes findings and recommendations. What is the MOST important action for the organization to take after the report is issued?

   • AAssign owners and deadlines for each recommended action and track their progress
   • BFile the report and review it again at the next scheduled audit
   • CShare the report with all employees to raise security awareness
   • DDestroy the report to prevent sensitive information from leaking
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is responsible for testing a new application that will be deployed in a highly regulated environment. The team has limited time and must choose between a penetration test and a code review. The primary concern is to identify as many vulnerabilities as possible before deployment. The application is a small, internally developed web application. Which technique is MOST likely to identify a broader range of vulnerabilities?

   • ACode review, because it can identify logic flaws and injection vulnerabilities that a penetration test might miss
   • BPenetration test, because it tests the application in its deployed state
   • CSocial engineering test, because it tests the human element of the application
   • DVulnerability scan, because it is fast and covers a wide range of known vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team must test a new web application that handles sensitive customer data. The team has a limited budget and must choose between a vulnerability scan and a penetration test. The team wants to identify exploitable vulnerabilities that could lead to a data breach. Which technique is MORE appropriate for this goal?

   • ACode review, because it examines the source code for flaws
   • BVulnerability scan, because it is faster and cheaper
   • CPenetration test, because it actively exploits vulnerabilities to determine their real-world impact
   • DSocial engineering test, because it tests user behavior
   Reveal Solution Discussion Select an answer first