The Impact of Regulations on Security Regulations CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which regulation is specifically applicable to the healthcare industry and requires safeguards for protected health information (PHI) during testing?

   • ASOX
   • BPCI DSS
   • CGDPR
   • DHIPAA
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A multinational company's security test team is responsible for testing a web application used by customers in the European Union. The EU's General Data Protection Regulation (GDPR) is updated with new guidance on data protection impact assessments (DPIAs). The team must adjust its testing process to remain compliant. What is the most appropriate action?

   • AAssign a developer to read the guidance and decide if any changes are needed without involving the test team.
   • BIgnore the new guidance because GDPR has not changed legally.
   • CWait for the next annual audit to see if the new guidance affects the testing process.
   • DReview the new guidance and update the test strategy to include DPIA-related test cases where the application processes personal data.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm is developing a new online banking application. The security test team must align its test strategy with PCI DSS requirements. The team has limited time and budget. Which approach best aligns the test strategy with PCI DSS while managing constraints?

   • APerform testing only after the application is in production to ensure the test results reflect the live environment.
   • BPrioritize testing of the cardholder data environment (CDE) and all systems that could impact its security, using risk-based testing to allocate effort.
   • CConduct a full penetration test of every feature, including non-cardholder data functions, to ensure comprehensive coverage.
   • DFocus exclusively on external network scans and skip application-level testing because PCI DSS only requires network scans.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How do regulatory compliance requirements typically influence test planning in a security testing project?

   • AThey only affect the final report, not the planning phase.
   • BThey eliminate the need for risk-based testing because compliance is the only priority.
   • CThey define specific security test cases that must be executed to meet compliance.
   • DThey require all testing to be performed by external auditors only.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How do regulations typically shape the overall security test strategy?

   • AThey require that testing focus primarily on areas that are subject to compliance obligations.
   • BThey eliminate the need for risk assessment because compliance defines all testing.
   • CThey require that all testing be performed using automated tools only.
   • DThey require that all testing be performed by the development team.
   Reveal Solution Discussion Select an answer first