Certified Tester Security Test Engineer (CT-STE)

0/8 checked

Q_01 domain/d1 · medium single discuss →

A security team is classifying an internal traffic-information display system where the timely availability of data to a large audience matters most, while confidentiality of the data is not a concern. According to the asset classification guidance, which security level and CIA pillar most likely apply, and what does this imply for security testing?

A High security level, confidentiality pillar; security testing is a must
B Low security level, availability pillar; security testing might not be necessary
C Medium security level, integrity pillar; security testing will be necessary
D Low security level, integrity pillar; security testing is a must

Q_02 domain/d1 · medium single discuss →

During an engagement, an auditor discovers that certain security policies and procedures cannot be exercised through dynamic execution. How do security audits and security testing complement each other in this situation?

A Security audits guarantee all vulnerabilities are found, so no further testing is required
B Security testing replaces the audit because it examines policies directly
C Auditing identifies deficiencies and areas to test, while security testing proves whether controls are in place and working effectively
D Audits are dynamic testing and security testing is static, so they cannot be combined