The Impact of Organizational Structures in the Context of Security Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A project-based organization creates a temporary team for a 6-month government contract. The team includes developers, a security tester, and a project manager, all reporting directly to the project manager. The security tester wants to report a critical finding to the organization's central security office, but the project manager insists on reporting only to the client. What is the MOST significant risk of following the project manager's directive?

   • AThe central security office may not learn of the vulnerability, leaving other projects in the organization exposed.
   • BThe client will likely reject the security test results because they were not involved in the planning.
   • CThe security tester will be in violation of the organization's code of conduct.
   • DThe project manager lacks the authority to approve the release of security test findings.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A non-profit organization has a flat structure with a small IT team. They are planning to conduct a security assessment of their donor database. There is no dedicated security tester, and the IT team has limited security expertise. What is the MOST appropriate approach for the organization?

   • ADefer the security assessment until the organization can afford a full-time security team.
   • BAsk the IT team to conduct the assessment using online tutorials and free tools.
   • CHire an external security consultant to conduct the assessment and provide recommendations.
   • DCreate a new security department and hire a full-time security tester.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational corporation with a matrix structure is undergoing a merger. The security testing team is now split across two reporting lines: one from the legacy company and one from the new partner. The two lines have conflicting testing methodologies and reporting formats. What is the MOST effective way to integrate the two teams?

   • AEstablish a joint task force with representatives from both teams to define a unified testing methodology and reporting standard.
   • BKeep the two teams separate and have them report to different executives.
   • CAdopt the methodology of the larger team and require the smaller team to comply.
   • DOutsource security testing to a third-party vendor to avoid the integration issue.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A large enterprise with a matrix structure is adopting a DevOps culture. Security testers are embedded in product teams, but they still report to a central security officer. The central security officer wants to enforce a standardized security testing toolchain across all teams, while individual product teams want to use their own tools to speed up delivery. What is the BEST way to resolve this tension while maintaining effective security testing?

   • AMandate the central security officer's toolchain for all teams to ensure consistency and comparability of results.
   • BAllow product teams to choose their own tools, but require them to report security metrics in a standardized format to the central security officer.
   • CHave the central security officer conduct all security testing centrally, removing testers from product teams.
   • DEliminate the central security officer role and let each product team manage its own security testing independently.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In which organizational structure are security testers typically assigned to a dedicated project team for the duration of the project and then reassigned to a new project?

   • AProject-based structure
   • BFunctional structure
   • CNetwork structure
   • DMatrix structure
   Reveal Solution Discussion Select an answer first