Security Test Reporting CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security test report includes a finding that requires a code change. The development team asks for a proof-of-concept exploit to verify the vulnerability. The client's policy prohibits sharing exploit code. How should the report address this?

   • AInclude the exploit code in the report to help the development team verify the finding.
   • BProvide a detailed technical description of the vulnerability and steps to reproduce it without including the exploit code.
   • CProvide a link to a public exploit database.
   • DRemove the finding from the report because the exploit code cannot be shared.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security test report is being prepared for two audiences: the board of directors and the development team. The board needs to understand the overall risk to the organization, while the development team needs to fix the vulnerabilities. The report is limited to 20 pages. How should the report be structured?

   • AWrite a single report with an executive summary for the board and detailed technical sections for the development team.
   • BWrite two separate reports: one for the board and one for the development team.
   • CWrite only a technical report and let the board read it.
   • DWrite only an executive summary and let the development team infer the technical details.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a risk-based security test report, how should findings be presented to help stakeholders focus on the most critical issues first?

   • ARandomly to avoid bias
   • BIn the order they were discovered during testing
   • CIn alphabetical order by vulnerability name
   • DGrouped by risk level, with critical findings listed first
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which audience would most likely require detailed technical descriptions of vulnerabilities, including proof-of-concept code and affected code snippets?

   • ASenior executives
   • BExternal auditors
   • CDevelopers and system administrators
   • DLegal and compliance officers
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a valid metric for security test reporting?

   • AThe number of testers on the team
   • BThe color of the test report cover
   • CNumber of vulnerabilities found per test
   • DThe brand of the testing tools used
   Reveal Solution Discussion Select an answer first