The Impact of Organizational Structures in the Context of Security Testing CT-STE Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   Which organizational structure is most likely to result in security testing being planned and executed independently for each project, with limited cross-project standardization?

   • AProject-based structure
   • BHierarchical structure
   • CMatrix structure
   • DFunctional structure
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a project-based organizational structure, to whom does the security tester typically report for day-to-day work assignments?

   • AThe human resources department
   • BThe functional security manager
   • CThe chief information security officer (CISO)
   • DThe project manager
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company with a project-based structure has a security testing team that is temporarily assigned to a project. The project is a high-risk financial application. The project manager wants to use a risk-based testing approach, focusing only on the most critical functions. What is the MOST important factor for the security tester to consider when agreeing to this approach?

   • AEnsure that the risk-based approach is documented and approved by the project manager and the security testing team.
   • BFocus only on the functions that are easiest to test, regardless of risk.
   • CRefuse the risk-based approach because it is not as thorough as a full security test.
   • DConduct the risk-based testing but also perform a full test without informing the project manager.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   In a matrix organization, a security tester is working on a project that is behind schedule. The project manager asks the tester to reduce the scope of security testing to save time. The security manager has not been consulted. What is the MOST appropriate action for the tester?

   • AInform the project manager that the security manager must be consulted before any reduction in security testing scope.
   • BEscalate the issue to the CEO, as the project manager is not following the matrix structure.
   • CAgree to reduce the scope and document the decision in the project log.
   • DRefuse to do any security testing until the project manager and security manager reach an agreement.
   Reveal Solution Discussion Select an answer first