The Impact of Regulations on Security Regulations CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security test team is testing a new feature that allows users to export their personal data from a cloud application. The team needs to verify that the export function works correctly and complies with GDPR's data portability requirement. Which test approach is most appropriate?

   • ASkip testing the export function because it is a standard feature and unlikely to have defects.
   • BTest only the export function's performance, not the content of the exported data.
   • CUse real user data from production to ensure the export function works with actual personal data.
   • DTest the export function using synthetic data that mimics the structure of personal data, and verify that the exported file contains all fields in a machine-readable format.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a major international standard that specifies requirements for an information security management system (ISMS) and is commonly referenced in security testing contexts?

   • AIEEE 829
   • BISO/IEC 9126
   • CISO/IEC 27001
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security test team is working on a project for a client in the healthcare sector. The client requires that all testing activities comply with HIPAA. The team plans to use a cloud-based test environment that stores PHI. What must the team do before using the cloud environment?

   • AEnsure the cloud provider signs a business associate agreement (BAA) and that the environment is configured to restrict access to PHI.
   • BUse the cloud environment as-is because HIPAA does not apply to test environments.
   • CAsk the client to waive the BAA requirement because the testing is internal.
   • DAnonymize all PHI before storing it in the cloud, and then no BAA is needed.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software company is developing a mobile app that processes payment card data. The security test team has completed a series of tests, including penetration testing and code review. The compliance officer asks for evidence that the testing met PCI DSS requirements. What should the security test lead provide?

   • AA copy of the test plan and a list of testers' names, but no actual test results.
   • BThe raw vulnerability scan reports and penetration test results, along with a signed attestation of compliance.
   • CA verbal briefing to the compliance officer, since the tests were internal and no external auditor is involved.
   • DA summary email stating that all tests passed and no vulnerabilities were found.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security test team is responsible for testing a mobile health app that collects patient data. The team learns that a new data protection regulation will take effect in six months, requiring stricter consent mechanisms. What should the team do to prepare?

   • AFocus on other testing activities and address the new regulation during the next major release.
   • BAssume the current consent mechanism is sufficient and only test it after the regulation takes effect.
   • CWait until the regulation takes effect, then update the test plan and run the tests.
   • DUpdate the test plan now to include test cases for the new consent requirements, and schedule them to run before the regulation takes effect.
   Reveal Solution Discussion Select an answer first