Standards CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to tailor security testing activities to the context of the system under test?

   • ATo comply with all standards equally
   • BTo eliminate the use of testing tools
   • CTo reduce the need for security testing
   • DTo ensure that testing is comprehensive and relevant to the system's specific risks
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which standard provides a comprehensive framework for managing information security risks through the implementation of an information security management system (ISMS)?

   • AISO/IEC 25010
   • BOWASP Testing Guide
   • CISO/IEC 27001
   • DNIST SP 800-115
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company processes credit card payments and must comply with PCI DSS. The security test engineer is planning the annual testing activities. The company has a web application that handles cardholder data and a separate internal network that does not. According to PCI DSS requirements, which testing activity is MANDATORY?

   • APerform a monthly review of firewall rules
   • BPerform a quarterly vulnerability scan of the internal network
   • CConduct an annual penetration test on the web application
   • DRun a daily malware scan on all servers in the cardholder data environment
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security test engineer is part of a team that is implementing ISO/IEC 27001. The organization has a mature testing process, but it is not currently aligned with the ISMS. The engineer must integrate security testing into the ISMS. The organization has identified that a critical application has a high risk of data breach due to weak authentication. The ISMS requires a risk treatment plan. Which action BEST integrates the testing process with the ISMS?

   • AConduct a penetration test on the authentication mechanism and use the results to update the risk treatment plan
   • BImmediately implement multi-factor authentication (MFA) without testing
   • COutsource the penetration test to an external vendor and ignore the results
   • DDocument the risk in the risk register and defer testing to the next annual cycle
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the main focus of NIST SP 800-115?

   • AProviding guidance on security testing and assessment techniques
   • BDefining security controls for federal information systems
   • CSpecifying requirements for an ISMS
   • DEstablishing a risk management framework
   Reveal Solution Discussion Select an answer first