The Impact of Organizational Structures in the Context of Security Testing CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which organizational structure is characterized by employees reporting to both a functional manager (e.g., head of security) and a project manager (e.g., product lead) simultaneously?

   • AHierarchical structure
   • BFunctional structure
   • CProject-based structure
   • DMatrix structure
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a matrix organizational structure, who is typically responsible for defining the security testing standards and methodologies used by testers?

   • AThe project manager
   • BThe external auditor
   • CThe development team lead
   • DThe functional manager (e.g., head of security)
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a matrix organization, a security tester receives conflicting instructions from the project manager (urgent feature testing) and the security manager (full security regression). What is the most appropriate action for the tester?

   • APerform both tasks simultaneously without informing either manager
   • BIgnore the security manager and follow the project manager
   • CEscalate the conflict to both managers and seek a joint decision
   • DQuit the project and refuse to work
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A company is transitioning from a functional structure to a matrix structure to improve collaboration between development and security teams. Which of the following is the MOST important change for the security testing team to adapt to?

   • ASecurity testers will have a single, clear chain of command to the project manager only.
   • BSecurity testers will be required to obtain approval from both the functional manager and the project manager for every test case.
   • CSecurity testers will now report to both a functional security manager and a project manager, requiring them to balance two sets of priorities.
   • DSecurity testers will no longer be required to document their findings in a centralized repository.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   In a functional organization, a security tester discovers a vulnerability in a system owned by the marketing department. The tester's manager instructs them to fix the vulnerability directly. However, the marketing department has not authorized any changes to their system. What is the MOST appropriate action for the security tester?

   • AEscalate the issue to the CEO to resolve the conflict between the security manager and the marketing department.
   • BMake the change as instructed by the manager, since the manager has authority over the security testing team.
   • CDocument the vulnerability and wait for the next scheduled maintenance window to apply the fix.
   • DRefuse to make the change and instead report the vulnerability to the marketing department and request their authorization.
   Reveal Solution Discussion Select an answer first