Standards CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does ISO/IEC 27001 influence security testing processes within an organization?

   • AIt mandates the use of specific penetration testing tools
   • BIt provides a step-by-step testing methodology
   • CIt eliminates the need for vulnerability scanning
   • DIt requires that security testing be performed as part of the ISMS
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which NIST Special Publication provides technical guidance for conducting security testing and assessment?

   • ANIST SP 800-37
   • BNIST SP 800-30
   • CNIST SP 800-53
   • DNIST SP 800-115
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security test engineer is working for a company that processes credit card payments. The company is preparing for a PCI DSS audit. The engineer is reviewing the testing requirements. Which activity is a specific requirement of PCI DSS that is NOT typically required by other standards like ISO/IEC 27001?

   • AConducting a risk assessment to identify threats and vulnerabilities
   • BEstablishing an incident response plan
   • CImplementing a security awareness training program for employees
   • DPerforming quarterly vulnerability scans and annual penetration tests
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security test engineer is using the OWASP Testing Guide to test a web application that allows users to upload files. The engineer wants to ensure that the file upload functionality is secure. According to the OWASP Testing Guide, which testing technique is specifically relevant to this functionality?

   • ATesting for cross-site scripting (XSS) in the file download response
   • BTesting for SQL injection in the file name parameter
   • CTesting for malicious file uploads that could execute code on the server
   • DTesting for session fixation in the upload session
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which component of the OWASP Testing Guide provides a structured approach to testing a specific security control or vulnerability class?

   • ATesting techniques
   • BChecklists
   • CIncident response procedures
   • DRisk assessment framework
   Reveal Solution Discussion Select an answer first