Understand the Usage and Concepts of Dynamic Test Tools CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which type of information does a network vulnerability scanner typically report?

   • AThe application's business logic flaws
   • BOpen ports and associated services
   • CThe personal opinions of the development team
   • DThe exact contents of database records
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which statement best describes the primary purpose of dynamic test tools in security testing?

   • ATo review configuration files and deployment scripts for security misconfigurations
   • BTo execute an application and observe its behavior to identify runtime vulnerabilities
   • CTo analyze source code for vulnerabilities without executing the application
   • DTo interview developers about security practices and code review procedures
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is using a network vulnerability scanner to assess a DMZ. The scanner reports a critical vulnerability in an outdated version of OpenSSH. What should the analyst do next?

   • AImmediately patch the OpenSSH service on all affected hosts.
   • BVerify the finding manually and assess the exploitability in the context of the network.
   • CRun a web application scanner to confirm the vulnerability.
   • DIgnore the finding because network vulnerability scanners are often inaccurate.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is typically performed using penetration testing tools?

   • ABacking up production databases
   • BDesigning the application's user interface
   • CCompiling source code into a binary
   • DExploiting a discovered vulnerability to gain access
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security tester is using a web application scanner to assess a custom e-commerce application. The scanner reports a critical SQL injection vulnerability in the login form. However, manual verification shows the input is properly parameterized and the report is a false positive. Which action should the tester take to improve the accuracy of future scans?

   • ADisable the scanner's SQL injection test module to avoid similar false positives.
   • BIgnore the report and continue with the same scanner configuration for all future tests.
   • CConfigure the scanner to exclude the login page from all future scans.
   • DAdjust the scanner's detection threshold and add the login form to a false-positive exception list.
   Reveal Solution Discussion Select an answer first