The Impact of Regulations on Security Regulations CT-STE Practice Questions (Page 6)

Questions 26–27

1. 26expert · medium

   A security test team has completed a series of tests for a financial application. The compliance officer requests a report that demonstrates compliance with PCI DSS. The team has test results from multiple tools, including vulnerability scans and penetration tests. What is the most appropriate way to compile the report?

   • AProvide a single consolidated report that includes the scope of testing, the tools used, the findings, and the remediation status.
   • BProvide separate reports for each tool, without a summary, to avoid overwhelming the compliance officer.
   • CProvide a summary of the results without technical details, to protect the organization's security posture.
   • DProvide only the penetration test report, since it is the most comprehensive.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security test team is planning tests for a new e-commerce platform that will process customer data, including payment information. The platform must comply with PCI DSS and GDPR. The team needs to define the test plan. Which consideration is most important for the test plan?

   • AIncluding test cases that verify the protection of cardholder data and the proper handling of personal data, such as data minimization and consent.
   • BFocusing only on PCI DSS requirements because GDPR does not apply to payment data.
   • CTesting only the payment processing functions and ignoring other personal data handling.
   • DCreating a single test plan that only includes security tests, not privacy tests.
   Reveal Solution Discussion Select an answer first