Standards CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which standard or guide is primarily focused on providing practical testing techniques and checklists for web application security testing?

   • AISO/IEC 25010
   • BISO/IEC 27001
   • COWASP Testing Guide
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the ISO/IEC 25010 quality model, which security sub-characteristic addresses the degree to which a system limits access to authorized users only?

   • AConfidentiality
   • BNon-repudiation
   • CAccountability
   • DIntegrity
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security test engineer is developing a test plan for a healthcare application that stores patient records. The organization must comply with both ISO/IEC 27001 (ISMS) and PCI DSS because it also processes credit card payments for patient co-pays. The test manager wants to avoid duplicating testing efforts. The engineer must map the testing activities to both standards. Which approach BEST aligns the testing activities with both standards?

   • APrioritize PCI DSS testing and skip ISO/IEC 27001 testing because the ISMS is a management standard, not a testing standard
   • BUse the OWASP Testing Guide exclusively and ignore both ISO/IEC 27001 and PCI DSS requirements
   • CConduct a single comprehensive penetration test that covers both the patient data and the payment processing functions, and document how it satisfies both standards
   • DPerform two separate penetration tests: one for the healthcare application and one for the payment system
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security test engineer is planning a security assessment for a large organization with multiple business units. The assessment must cover both internal and external systems. The engineer is using NIST SP 800-115 as the primary reference. The organization has a limited budget and wants to maximize the value of the assessment. Which approach aligns with NIST SP 800-115's guidance?

   • APrioritize testing based on the criticality of the systems and the likelihood of attack
   • BConduct a full penetration test of all systems, including every business unit, regardless of risk
   • CUse only automated tools to reduce the cost of testing
   • DOutsource the testing to an external vendor to reduce the burden on internal staff
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is implementing ISO/IEC 27001 and has established an Information Security Management System (ISMS). The security test engineer is asked to align the testing process with the ISMS requirements. The organization has identified a risk that a critical business application may be vulnerable to a new type of injection attack. According to ISO/IEC 27001, what should the engineer do FIRST?

   • AReport the vulnerability to the application owner and wait for instructions
   • BImmediately patch the application to eliminate the vulnerability
   • CUpdate the risk assessment to reflect the new threat and determine the appropriate risk treatment
   • DDevelop a detailed test case for the injection attack and execute it immediately
   Reveal Solution Discussion Select an answer first