The Concept of OSS and Its Impacts on Security Testing CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is license compliance important in the security testing strategy for OSS?

   • ABecause using OSS under an incompatible license can lead to legal obligations that affect the application's distribution.
   • BBecause licenses determine the security features that the OSS provides.
   • CBecause licenses must be scanned for malware.
   • DBecause licenses contain security vulnerabilities that need to be tested.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is deciding whether to use a relatively new open-source encryption library that has a small user base but is actively developed. What is the most balanced approach to assessing its security?

   • AConduct a thorough security review of the library's source code and its dependencies.
   • BUse the library without review because it is open source.
   • CReject the library because it is not widely used.
   • DAccept the library because it is actively developed.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security tester is testing a web application that uses an open-source framework. The framework has a known vulnerability in a specific version, but the application uses a patched version. However, the application includes a custom module that overrides a core function of the framework. What is the most important consideration for the security tester?

   • AThe framework's patched version is secure, so no further testing is needed.
   • BThe custom module may introduce new vulnerabilities that are not present in the framework.
   • CThe framework's known vulnerability is still present despite the patch.
   • DThe custom module should be removed because it is not part of the framework.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security tester is evaluating an open-source library that has a known vulnerability in its default configuration. The library is used in a way that mitigates the vulnerability, but the mitigation is not documented. What is the most appropriate action?

   • ADocument the mitigation and verify that it is effective in the application's context.
   • BReport the vulnerability as a finding without considering the mitigation.
   • CAssume the vulnerability is not exploitable because the library is open source.
   • DReplace the library immediately to avoid the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When testing an application that integrates OSS components, what should a security tester consider?

   • AOnly the OSS components need to be tested, not the application code.
   • BThe OSS components should be tested in isolation, without considering the application context.
   • CThe OSS components are secure if they are widely used, so no testing is needed.
   • DThe integration points between the OSS components and the application, as these can introduce vulnerabilities.
   Reveal Solution Discussion Select an answer first