CT-SEC

CT-SEC practice questions, page 2 of 2, with answer review and explanations.

Question 6

Scenario:An international health insurance company has an advanced management system for its services that can be accessed by different types of stakeholders.As a consequence of a deficiency in the security requirements for a new module, a data access monitoring process has not been implemented for the stakeholders involved in customer management. This feature implies that, every time any corporate stakeholder accesses a customer’s data, a record must be kept identifying the user, date and time of access as well as the reason(s) for accessing this data.Question:Based on the above scenario, which TWO aspects associated with the requirements could be impacted by the implementation of the solution? (Choose two.)

  1. Privacy
  2. Compliance Needs
  3. Interoperability
  4. Testability
  5. Usability

Question 7

Background:CAPTCHA stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart. A CAPTCHA is a program that protects websites against bots by generating and grading tests that humans can pass but current computer programs cannot. For example, humans can read distorted text, but current computer programs cannot.Scenario:A web application available for mobile devices provides value-added services upon free registration of future users. This application provides a series of free and other paid services. The project’s security manager has proposed to include a CAPTCHA during the registration process.Question:Which ONE of the following objectives of security tests for this feature is CORRECT?

  1. When a tool is used to try to bypass the CAPTCHA, it checks the vulnerability of the software system in terms of mass account creation requests.
  2. By testing the CAPTCHA on both mobile and web, ensure that CAPTCHA works on both types of systems.
  3. CAPTCHA is a proven technology and no security testing may need to be performed for it.
  4. If CAPTCHA works correctly, then bypassing it using a tool is not a security test because it is a CAPTCHA library problem and not an application security vulnerability.

Question 8

A firewall has been implemented so that communications can be filtered according to users being the connections and data according to pattern descriptions.What type of access restriction product or mechanism is described above?

  1. Network filtering
  2. Web application firewall
  3. Port filtering
  4. Resource filtering

Question 9

George is a security tester who is using a suite of tools to perform different tasks, such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. He aims to determine the hosts available on the network, services and OS versions they are running, what type of packet filters and/or firewalls are in use and also to make a list of string parameters like ‘ or “, -- or #, /*…*/, +, ||, %, PRINT.Which TWO of the following types of testing is George performing? (Choose two.)

  1. Network discovery and security audit
  2. Data validation testing
  3. Detecting and exploiting the SQL injection flaws
  4. Planning to transfer the data
  5. Data obfuscation