CT-STE

CT-STE practice questions, page 2 of 2, with answer review and explanations.

Question 6

ElectricCars is a multinational automotive manufacturer specializing in designing and producing electric vehicles. The company must comply with three standards regarding the manufacturing process: ISO/SAE 21434 for automotive cybersecurity engineering, GDPR (General Data Protection Regulation), and UN Regulation No. 155 (Uniform provisions concerning the approval of vehicles regarding cyber security and cyber security management system).Compliance with these regulations requires:secure data storage and communication within vehicles and between vehicles and backend systems emergency procedures to handle cybersecurity breaches affecting production, vehicles in operation, or customer data transparent reporting mechanisms to regulators and customers in case of incidentsWhich of the following is a security test that is a consequence of the compliance requirement?

  1. Simulate a data breach and test the notification process to members of the development team, ensuring clear communication and legal compliance
  2. Conduct performance testing on production systems to test response protocols, including isolating infected systems, notifying stakeholders, and restoring operations
  3. Trying to gam unauthorized access to offices or secure areas of automotive dealerships, where sensitive customer or vehicle data might be stored
  4. Regularly test the integrity and reliability of backup systems for critical data, including production logs, customer information, and vehicle firmware versions

Question 7

Which of the following is an advantage of using open-source software (OSS) in the context of security testing?

  1. Data protection is typically stronger in OSS than in closed source software.
  2. Typically, there are fewer attack vectors for OSS than for closed software.
  3. Mitigating vulnerabilities is easier due to the availability of source code.
  4. Less people are involved in identifying vulnerabilities and fixing defects.

Question 8

Which TWO of the following security tests of a mobile banking application are examples of static security testing? (Choose two.)

  1. Review of the source code of the application to identify vulnerabilities such as hardcoded passwords or insecure cryptographic functions.
  2. Runtime vulnerability scanning while the application is running on a test server, looking for vulnerabilities such as data leakage during user transactions.
  3. Penetration testing by simulating real-world attacks on the bank’s live web application, attempting to exploit session hijacking.
  4. Scanning, with a tool, the application’s source code for security flaws like buffer overflows or improper authentication mechanisms.
  5. Using a tool to interact with the application in a running state to scan for vulnerabilities such as cross-site scripting by sending inputs and analyzing responses.