The Security Test Environment CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An e-commerce company is preparing to test its payment processing system for vulnerabilities. The test environment needs a large dataset of transactions to simulate realistic attack scenarios. The company has a copy of production data, but it contains customer credit card numbers and personal information. What is the best approach to manage this test data?

   • AGenerate synthetic data that mimics the structure and distribution of production data, without using any real customer information.
   • BUse a small subset of production data and remove all credit card numbers.
   • CUse the production data as-is, since the test environment is isolated and secure.
   • DEncrypt the production data before loading it into the test environment.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security test team has made several changes to the test environment during a test campaign, such as installing new tools and modifying configurations. At the end of the campaign, they need to produce a report. What should they include in the report regarding the environment?

   • AA list of the tools used, but not the configuration changes.
   • BThe names of the testers who performed the tests, but not the environment details.
   • COnly the final configuration of the environment.
   • DA summary of all changes made to the environment, including dates and who made them.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security tester is setting up an environment to test a mobile application's backend API. The API connects to a database and uses an authentication service. Which set of components must be included in the test environment to accurately reflect the production environment?

   • AA production database with real user data, but no authentication service.
   • BThe API server and a network simulator, but no database.
   • CThe API server, a database instance, and a mock authentication service.
   • DOnly the API server, since the other components are not needed for security testing.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the goal when configuring a security test environment to reflect the production environment?

   • ATo include all production data, including sensitive information
   • BTo simplify the environment to reduce testing time
   • CTo replicate the production environment as closely as possible while allowing for safe testing
   • DTo use the latest versions of all software, regardless of production
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security test team needs to test an application that processes credit card payments. They need test data that includes valid credit card numbers to test the payment flow. What is the best way to obtain this data?

   • AGenerate random numbers that follow the Luhn algorithm.
   • BUse real credit card numbers from a sample of customers who have consented.
   • CUse publicly available test credit card numbers provided by payment processors.
   • DUse the credit card numbers from the production database, but mask them.
   Reveal Solution Discussion Select an answer first