Security Test Reporting CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a standard component of a security test report?

   • AA list of all network devices with their serial numbers
   • BA list of all employees' passwords
   • CA marketing summary of the organization's products
   • DA detailed description of the test environment and scope
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security test report includes a finding of a medium-risk misconfiguration in a firewall rule. The client asks for actionable remediation guidance. What should the report include?

   • AA statement that the misconfiguration should be fixed as soon as possible.
   • BA recommendation to review all firewall rules periodically.
   • CA note that the misconfiguration is low priority and can be ignored.
   • DSpecific steps to correct the firewall rule, such as removing the overly permissive source address and restricting access to required IPs.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security testing team is preparing a quarterly report for management. The report includes metrics on vulnerabilities found and remediated. Management wants to see the trend over the last four quarters. Which presentation would be most effective?

   • AA line chart showing the number of vulnerabilities found and fixed over the four quarters.
   • BA pie chart showing the distribution of vulnerabilities by severity for the latest quarter.
   • CA table listing the number of vulnerabilities found and fixed for each quarter.
   • DA bar chart comparing the total number of vulnerabilities found in the first and last quarters.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security test report is being prepared for a client. The client expects a standard structure. Which section should be included to provide context about the scope and limitations of the testing?

   • AIntroduction and Scope
   • BDetailed Findings
   • CExecutive Summary
   • DRecommendations
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security testing team wants to demonstrate improvement in vulnerability management over time to senior management. Which metric would be most meaningful for this purpose?

   • ATotal number of vulnerabilities found in the latest test cycle.
   • BAverage time to remediate high-severity vulnerabilities.
   • CNumber of security tools used during testing.
   • DNumber of testers on the team.
   Reveal Solution Discussion Select an answer first