The Impact of Organizational Structures in the Context of Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small company with a flat structure has a single security tester who reports directly to the CEO. The CEO wants to launch a new product quickly and asks the tester to skip the full security test to meet the deadline. The tester believes the product has significant security risks. What is the MOST appropriate action for the tester?

   • AConduct the full security test secretly and delay the product launch without informing the CEO.
   • BCommunicate the risks to the CEO in business terms and propose a risk-based testing approach that covers the most critical areas within the time constraint.
   • CRefuse to launch the product and threaten to resign if the CEO proceeds without a full security test.
   • DComply with the CEO's request and launch the product without any security testing.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A software company uses a matrix structure. A security tester is assigned to a product team and also reports to the security manager. The security manager asks the tester to spend 50% of their time on a new security initiative, but the product manager insists the tester is needed full-time for the upcoming release. What is the MOST appropriate way for the tester to handle this conflict?

   • AFollow the security manager's instructions, since they have functional authority over the tester's role.
   • BFollow the product manager's instructions, since the tester is assigned to the product team.
   • CDiscuss the conflict with both managers and propose a revised allocation that meets the most critical needs of both parties.
   • DEscalate the conflict to the CEO immediately without discussing it with the managers.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization has a functional structure with a centralized security team. Which security testing approach is most aligned with this structure?

   • AEach developer tests their own code for security issues without coordination
   • BThe central security team defines and executes a standardized testing program for all projects
   • CEach project team hires its own external penetration testers independently
   • DSecurity testing is performed only when a customer explicitly requests it
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A startup with a flat, project-based structure has no dedicated security team. Developers are responsible for security testing their own code. The company is about to launch a public API and wants to ensure it is secure without hiring new staff. Which approach BEST fits this organizational context?

   • AAdopt a formal matrix structure with a security lead from each project team.
   • BImplement a lightweight security testing checklist and require peer review of test results for each release.
   • CHire a full-time security testing team to handle all testing centrally.
   • DOutsource all security testing to a third-party vendor on a one-time basis before launch.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   In a functional organization, the security testing team reports to the IT operations manager. During a penetration test, the team finds a critical vulnerability in a legacy application owned by the finance department. The finance department refuses to acknowledge the risk because they were not involved in the test planning. What is the PRIMARY reason this conflict occurred?

   • AThe penetration test should have been conducted by an external vendor to be considered valid.
   • BThe IT operations manager lacks the technical skills to evaluate the penetration test results.
   • CThe security testing team did not coordinate with the finance department as a key stakeholder before the test.
   • DThe finance department is not required to comply with security testing policies.
   Reveal Solution Discussion Select an answer first