The Concept of OSS and Its Impacts on Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a permissive open source license?

   • AEclipse Public License (EPL)
   • BMIT License
   • CMozilla Public License (MPL)
   • DGNU General Public License (GPL)
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which security testing technique is particularly useful for OSS components because it leverages public vulnerability databases?

   • ADependency vulnerability scanning
   • BPenetration testing
   • CStatic code analysis
   • DFuzzing
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which characteristic is essential for software to be classified as Open Source Software (OSS)?

   • AThe software must be hosted on a public repository like GitHub.
   • BThe software must be developed by a non-profit organization.
   • CThe software must be available at no cost.
   • DThe source code must be available and the license must permit modification and redistribution.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a security benefit of community review in OSS projects?

   • AIt ensures that the software is compliant with all security standards.
   • BIt prevents the introduction of any new vulnerabilities.
   • CIt guarantees that all code changes are security-reviewed before release.
   • DIt increases the likelihood that vulnerabilities are discovered and reported by many independent reviewers.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security tester is assigned to test a web application that uses an open-source content management system (CMS) with custom plugins. What is the most effective testing approach?

   • APerform a black-box test only, as source code analysis is not necessary for OSS.
   • BTest only the custom plugins, as the CMS core is widely used and therefore secure.
   • CTest the CMS core and all plugins, including custom plugins, for vulnerabilities.
   • DTest only the CMS core, as plugins are third-party and not the application's responsibility.
   Reveal Solution Discussion Select an answer first