Sequential Development Models CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key activity in vulnerability management during the maintenance phase?

   • AConducting initial security requirements analysis
   • BMonitoring and applying security patches to address known vulnerabilities
   • CPerforming static code analysis on the initial codebase
   • DDesigning the system's security architecture
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security tester is evaluating whether to recommend a Waterfall model for a new project. The project has a very tight deadline and the business expects to see a working, secure product quickly. The tester knows that security testing in Waterfall typically happens late in the lifecycle. What is the main security-related risk of this approach?

   • ASecurity testing is performed too early to be effective
   • BSecurity requirements are never documented
   • CSecurity defects are discovered late, making them more expensive and time-consuming to fix
   • DThe system cannot be maintained after release
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital's patient portal has been in production for two years. A new vulnerability in the underlying web framework was announced last week. The security team must ensure the system remains secure while a fix is developed. What is the most appropriate action in the maintenance phase?

   • ARe-run the full security test suite from the original testing phase
   • BRedesign the entire application to use a different framework
   • CApply a virtual patch or compensating control and track the vulnerability until the official fix is deployed
   • DIgnore the vulnerability because the system has been stable for two years
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of static code analysis during the implementation phase?

   • ATo test the system's behavior under real-world attack conditions
   • BTo measure the system's performance under high load
   • CTo identify security vulnerabilities in the source code without executing it
   • DTo verify that the system meets user acceptance criteria
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services firm is in the design phase of a V-model project. The architecture includes a new customer-facing web portal and a backend database. The security lead wants to identify potential attack vectors before any code is written. Which activity is most appropriate at this stage?

   • AConducting a threat modeling workshop with the architects and developers
   • BExecuting a full penetration test against the production environment
   • CRunning a dynamic application security test (DAST) against the staging environment
   • DPerforming a source code review of the authentication module
   Reveal Solution Discussion Select an answer first