The Impact of Organizational Structures in the Context of Security Testing CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A government agency has a highly formalized functional structure. Security testing is performed by a dedicated team that reports to the IT director. The agency is planning to migrate a critical application to the cloud. What is the MOST important consideration for the security testing team when planning the cloud migration tests?

   • AEnsure that the testing plan is reviewed and approved by the IT director and follows the agency's formal change-management process.
   • BDelegate all security testing decisions to the cloud service provider.
   • CUse a cloud-native security testing tool that is not approved by the agency's security policy.
   • DConduct the security tests without informing the IT director to avoid delays.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company with a project-based structure is running multiple concurrent projects. Each project has its own security tester, and there is no central security function. A vulnerability discovered in one project is likely present in another project because they share a common codebase. What is the MOST significant challenge this structure presents for security testing?

   • AProject managers will have conflicting priorities and will not allocate enough time for security testing.
   • BThe lack of a central security function means there is no mechanism to share findings across projects, leading to duplicated effort and unmitigated risks.
   • CThe organization will not be able to comply with external security regulations.
   • DSecurity testers will not have the necessary technical skills to test the shared codebase.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is transitioning from a functional to a project-based structure. In the functional structure, security testers were centralized and reported to a security manager. In the new structure, they will be assigned to individual projects and report to project managers. What is the MOST significant risk of this transition for security testing?

   • ASecurity testers will have to travel more frequently to different project sites.
   • BProject managers will not understand the technical details of security testing.
   • CSecurity testers will have less job security because they are assigned to temporary projects.
   • DLoss of a central security perspective, leading to inconsistent testing practices and reduced knowledge sharing across projects.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational bank uses a matrix structure where security testers report to a central CISO office but are assigned to product development squads. A tester discovers a critical authentication flaw in a mobile banking app. The product manager wants to delay the fix to meet a release deadline, while the CISO office demands immediate disclosure to the board. What is the MOST appropriate action for the tester?

   • AComply with the product manager's request to delay the fix, since they control the product timeline and resources.
   • BQuietly fix the vulnerability during off-hours without updating the release plan or notifying stakeholders.
   • CReport the issue directly to the board of directors without informing either the product manager or the CISO office.
   • DEscalate the conflict to the CISO office, which holds functional authority over security testing priorities.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a functional organizational structure, how does the reporting line for security testing results typically flow?

   • AThrough the functional manager (e.g., head of security) to higher management
   • BDirectly from the security tester to the project sponsor
   • CThrough the project manager to the steering committee
   • DDirectly to the development team lead
   Reveal Solution Discussion Select an answer first