Standards CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security test engineer is preparing a presentation for management about the importance of security testing standards. The engineer wants to explain the difference between ISO/IEC 27001 and ISO/IEC 25010. Which statement is ACCURATE?

   • AISO/IEC 27001 is a management system standard, and ISO/IEC 25010 is a quality model
   • BBoth standards are focused on software quality characteristics
   • CBoth standards are certification standards for security testing processes
   • DISO/IEC 27001 provides technical testing procedures, and ISO/IEC 25010 provides management guidelines
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security test engineer is planning a network penetration test for a large enterprise. The test must be conducted in a way that minimizes the risk of disrupting production services. The engineer is reviewing NIST SP 800-115 for guidance. Which testing technique, as described in NIST SP 800-115, should the engineer use to minimize disruption?

   • AUse passive network monitoring to observe traffic without sending packets
   • BUse active vulnerability scanning to identify open ports and services
   • CUse a social engineering test to assess employee awareness
   • DUse a full-scale penetration test that exploits every identified vulnerability
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A test engineer is explaining to a new team member how different standards support security testing. The engineer wants to clarify that ISO/IEC 25010 provides a framework for defining security quality characteristics, while the OWASP Testing Guide provides practical testing techniques. Which statement correctly describes the relationship between these two standards?

   • AThe OWASP Testing Guide defines security characteristics, and ISO/IEC 25010 provides the testing checklists
   • BISO/IEC 25010 and the OWASP Testing Guide both provide step-by-step testing procedures
   • CBoth standards are management system standards that require certification
   • DISO/IEC 25010 defines the 'what' (security characteristics) and the OWASP Testing Guide defines the 'how' (testing techniques)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security test engineer is using the OWASP Testing Guide to plan a penetration test for a REST API that handles financial transactions. The engineer needs to ensure that the test covers the most relevant security risks for this type of application. According to the OWASP Testing Guide, which testing technique should the engineer prioritize?

   • ADenial-of-service testing to ensure the API can handle high traffic volumes
   • BInput validation testing to check for injection flaws in API parameters
   • CBusiness logic testing to verify that transaction limits are enforced correctly
   • DConfiguration management testing to verify that the API server is hardened
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security test engineer is planning the test approach for a web-based customer portal that handles personal data. The organization has adopted ISO/IEC 25010 as its quality model, and the test manager wants the security testing activities to be traceable to that standard. The engineer must select a testing technique that directly supports the 'Confidentiality' sub-characteristic defined in ISO/IEC 25010. Which activity should the engineer include in the test plan?

   • APerform a static analysis of the source code to identify hard-coded credentials
   • BConduct a session management test to verify that session tokens are not exposed in URLs or logs
   • CExecute a series of SQL injection tests against the login and search functions
   • DRun a load test to determine the maximum number of concurrent users the portal can handle
   Reveal Solution Discussion Select an answer first