Standards CT-STE Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   What is the primary purpose of the OWASP Testing Guide?

   • ATo provide a framework for managing information security risks
   • BTo set compliance requirements for payment card processing
   • CTo define quality characteristics for software products
   • DTo offer practical guidance for testing web application security
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security test engineer is working for a company that is about to undergo a PCI DSS audit. The company has a web application that processes credit card transactions. The auditor has asked to see evidence of the security testing activities. Which piece of evidence is MOST likely to satisfy the PCI DSS requirement for penetration testing?

   • AA report from a quarterly vulnerability scan of the web application
   • BA copy of the ISO/IEC 27001 certificate of compliance
   • CA report from an annual penetration test that includes the application layer and network layer
   • DA certificate of completion from an OWASP Testing Guide training course
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   What is the primary purpose of ISO/IEC 27001 in the context of security testing?

   • ATo certify individual security testers
   • BTo define the requirements for an information security management system (ISMS)
   • CTo specify technical security testing methods
   • DTo provide a detailed checklist for penetration testing
   Reveal Solution Discussion Select an answer first