Security Test Reporting CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security test found a high-risk vulnerability in a legacy system that cannot be patched immediately. What should the report recommend?

   • AApply compensating controls, such as network segmentation and enhanced monitoring, until a permanent fix is available.
   • BRecommend replacing the system with a new one immediately.
   • CIgnore the vulnerability because the system is legacy.
   • DImmediately decommission the legacy system.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security test identified a critical SQL injection vulnerability in a customer-facing application. The report must be shared with two audiences: the development team and the product manager. How should the findings be presented to each audience?

   • AGive the development team the technical details and the product manager a summary focusing on business risk and impact.
   • BSend only the executive summary to the development team to avoid overwhelming them.
   • CAsk the product manager to translate the technical report for the development team.
   • DProvide the same detailed technical report to both audiences to ensure consistency.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security test report contains findings with different risk levels. The report is intended for the IT operations team that will implement fixes. How should the findings be prioritized in the report?

   • ABy the ease of fixing, with the easiest fixes listed first.
   • BAlphabetically by the affected system name.
   • CBy the order in which they were discovered during testing.
   • DBy risk level, with high-risk findings listed first and clear remediation steps for each.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security testing team wants to report on the effectiveness of their testing process to management. Which KPI would best demonstrate the value of the security testing program?

   • APercentage of critical vulnerabilities remediated within the agreed SLA.
   • BNumber of test cases executed per day.
   • CTotal hours spent on security testing.
   • DNumber of security tools licensed.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security test report is being prepared for a client that requires compliance with a specific regulatory standard. The client wants to know if the application meets the standard's security requirements. What should the report include?

   • AA recommendation to hire a compliance consultant to interpret the report.
   • BA compliance mapping section that shows how each finding relates to the regulatory requirements.
   • CA list of all findings with their CVSS scores.
   • DA statement that the application is compliant because no critical findings were found.
   Reveal Solution Discussion Select an answer first