Security Test Reporting CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When communicating security test results to a non-technical management audience, which approach is most effective?

   • AFocusing on business risk, impact, and recommended actions in plain language
   • BUsing technical jargon and detailed exploit code
   • CSkipping the report and giving a verbal summary only
   • DProviding only raw scan output without interpretation
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What should a good remediation step include to be most useful to the team responsible for fixing the issue?

   • AA list of all employees who should be notified
   • BA clear description of the fix and any necessary configuration changes
   • CA promise to improve security awareness
   • DA statement that the issue is low priority
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security test report contains a finding that is rated as high risk based on the CVSS score. However, the affected system is a non-critical internal tool with limited data. The client wants to deprioritize this finding. How should the report handle this?

   • ALower the risk rating to medium to reflect the low business impact.
   • BRemove the finding from the report because the system is not critical.
   • CKeep the high-risk rating and insist on immediate remediation.
   • DKeep the technical severity but add a note that the business impact is low, and recommend a lower priority for remediation.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security test report contains 10 findings, including 2 critical, 3 high, 3 medium, and 2 low. The client has limited resources and can only fix 5 findings this quarter. The client wants to minimize overall risk. Which approach should the report recommend?

   • APrioritize findings based on a risk score that considers both severity and business impact, and select the top 5.
   • BFix the 5 findings that were discovered first.
   • CFix the 5 findings that are easiest to remediate, regardless of risk level.
   • DFix the 2 critical and 3 high findings, regardless of the effort required.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an actionable recommendation for a security finding?

   • AThe system should be more secure
   • BMonitor the system for unusual activity
   • CApply the vendor-provided security patch to the affected application server
   • DConsider improving security in the future
   Reveal Solution Discussion Select an answer first