CT-STEPreview

Which of the following is an example of testing a firewall?

Which of the following correctly describes the relationship between information sensitivity and security testing?

A tester used rainbow tables to perform a brute-force attack to discover user passwords. What kind of testing is it?

A company implements a policy where employees are only granted access to the specific systems and data necessary for their role, ensuring no user has more access than needed. The company also requires employees to use their password, and a time-based one-time passcode sent to their mobile device or an authenticator app, to access their internal systems. To safeguard against potential cyber threats, each employee’s laptop, mobile device, and tablet are equipped with security software that continuously monitors signs of suspicious activity, such as malware or unauthorized access attempts.
Which of the following Zero Trust concepts is MISSING from this scenario?

ElectricCars is a multinational automotive manufacturer specializing in designing and producing electric vehicles. The company must comply with three standards regarding the manufacturing process: ISO/SAE 21434 for automotive cybersecurity engineering, GDPR (General Data Protection Regulation), and UN Regulation No. 155 (Uniform provisions concerning the approval of vehicles regarding cyber security and cyber security management system).
Compliance with these regulations requires:
secure data storage and communication within vehicles and between vehicles and backend systems emergency procedures to handle cybersecurity breaches affecting production, vehicles in operation, or customer data transparent reporting mechanisms to regulators and customers in case of incidents
Which of the following is a security test that is a consequence of the compliance requirement?

Which of the following is an advantage of using open-source software (OSS) in the context of security testing?

Which TWO of the following security tests of a mobile banking application are examples of static security testing? (Choose two.)

You test a system that sends documents with sensitive data between users. One of the risks is that if an attacker gains access to such a document, they can read its content. What kind of testing verifies a mechanism that protects documents from being read by unauthorized persons?

Which of the following is a characteristic of an effective security test environment?

As a security tester, you defined the following test prioritization:

In which activity of the security test process was this action performed?

Which of the following correctly describes the role of security testing in the context of security audits?

Which of the following is an example of a security test at a component test level?

You have been asked to perform end-to-end testing for online payment processing and to focus on security tests to validate the secure transmission of payment details (e.g., enforcing HTTPS), proper encryption of sensitive data (e.g., credit card numbers) and adherence to compliance standards like PCI DSS.
Which of the following end-to-end security tests validates one of the above-mentioned requirements?

Your company is launching a new web-based e-commerce platform where customers can create accounts, browse products, and make purchases. As the platform will be integrated with payment gateways and handle sensitive customer information (like personal data and credit card details), your security team is concerned about potential vulnerabilities that attackers could exploit. To ensure robust security, you want to perform security tests to assess and mitigate the most common and critical web application security risks.
Which of the following will be MOST BENEFICIAL to your team for achieving this goal?

What is the name of a group of implementable, replicable, and transferable tasks that optimize the efficiency or effectiveness of the business discipline or process to which it contributes?