Understand the Usage and Concepts of Dynamic Test Tools CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security tester is using an interception proxy to analyze a web application. The application uses certificate pinning, and the tester cannot decrypt HTTPS traffic. Which technique should the tester use to bypass certificate pinning?

   • AUse a network vulnerability scanner to analyze the traffic.
   • BInstall the proxy's CA certificate on the device.
   • CUse a Frida script to hook the certificate validation function.
   • DDisable HTTPS and use HTTP instead.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security tester is using a web application scanner to assess a web application that uses a JavaScript-heavy single-page application (SPA). The scanner reports few vulnerabilities, but manual testing reveals several issues. What is the most likely reason for the scanner's poor performance?

   • AThe scanner is not configured to execute JavaScript.
   • BThe scanner is authenticated with low-privilege credentials.
   • CThe scanner is using too many attack payloads.
   • DThe scanner is configured to skip client-side tests.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary role of penetration testing tools?

   • ATo automatically fix all discovered vulnerabilities
   • BTo monitor network traffic for intrusion attempts
   • CTo simulate attacks to evaluate security controls
   • DTo replace the need for human testers
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security engineer is fuzzing a network protocol implementation. The protocol has a complex state machine, and the engineer wants to maximize coverage of state transitions. Which fuzzing approach is most effective?

   • AMutation-based fuzzing of captured network traffic
   • BManual testing of each state transition
   • CRandom fuzzing without any model
   • DGeneration-based fuzzing using a protocol grammar
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A penetration tester is conducting an assessment of a network with strict change-control policies. The tester has identified a potential critical vulnerability but is unsure if exploitation could disrupt services. What should the tester do?

   • ADocument the potential impact and obtain written authorization before attempting exploitation.
   • BProceed with exploitation to confirm the vulnerability.
   • CUse a vulnerability scanner to confirm the vulnerability without exploitation.
   • DIgnore the vulnerability because exploitation is too risky.
   Reveal Solution Discussion Select an answer first