CT-STE

Review 40 CT-STE practice questions with answer explanations and community insights.

Question 1

Which of the following is an example of reconciliation testing?

  1. Reviewing and re-approving employee access to sensitive systems, confirming that users still require the access based on their current job responsibilities
  2. Verifying that access rights of all active user accounts in the company’s HR system match the records in the identity management database
  3. Verifying that access to privileged accounts is reviewed annually to ensure that only authorized personnel retain such access
  4. Checking regularly that user accounts with access to customer data still need this access, ensuring that unneeded privileges are removed

Question 2

Which of the following is an example of testing a firewall?

  1. Ensuring that when queried, the system returns data masked or replaced with random characters, verifying that sensitive data is protected from unauthorized users
  2. Using a tool to scan the network and identify open ports, ensuring that only the necessary ports are open and that all other ports are properly blocked
  3. Verifying that the access of the system to the right roles is restricted, services are open only when needed, and application updates are properly monitored
  4. Using “brute force” or “dictionary” attacks to attempt to get plain data from obfuscated data, and performing reverse-engineering of byte code

Question 3

Which of the following correctly describes the relationship between information sensitivity and security testing?

  1. A popular e-commerce website requires rigorous stress testing, whereas a small personal blog may only need basic testing of login security mechanisms.
  2. A financial application storing customer data requires encryption validation, whereas a public news app may require basic security measures.
  3. A public forum website requires high-level integrity testing whereas an online banking platform primarily needs availability testing to ensure users can log in anytime.
  4. A hospital’s health record system requires minimal security testing since doctors primarily need availability, while a messaging app needs extensive testing to protect conversations.

Question 4

A tester used rainbow tables to perform a brute-force attack to discover user passwords. What kind of testing is it?

  1. Testing the authentication mechanism
  2. Testing the accounting mechanism
  3. Testing the authorization mechanism
  4. Testing the system hardening mechanism

Question 5

A company implements a policy where employees are only granted access to the specific systems and data necessary for their role, ensuring no user has more access than needed. The company also requires employees to use their password, and a time-based one-time passcode sent to their mobile device or an authenticator app, to access their internal systems. To safeguard against potential cyber threats, each employee’s laptop, mobile device, and tablet are equipped with security software that continuously monitors signs of suspicious activity, such as malware or unauthorized access attempts.Which of the following Zero Trust concepts is MISSING from this scenario?

  1. Security monitoring of device endpoints
  2. Micro-segmentation
  3. Multi-factor authentication
  4. “Least privilege access” principle
We are moving to a new platform

CertificationTest is being migrated. Some pages may be slow or briefly unavailable; everything will be back to normal within a few hours. If you run into any issue, email support@certificationtest.net.