What is a key characteristic of qualitative risk analysis?

It requires precise historical data for all assets

It always produces a single definitive risk value

It relies on subjective ratings such as high, medium, and low

It uses numerical values and monetary amounts to express risk

A security tester is performing a risk assessment for a healthcare organization's patient portal. The tester needs to assign a monetary value to the potential loss if patient records are exposed, and also estimate the annual frequency of such an event. Which risk analysis approach is the tester applying?

Semi-quantitative risk analysis

A security tester is conducting a risk assessment for a manufacturing company's industrial control system (ICS). The tester needs to identify potential threats and vulnerabilities. Which technique is most appropriate for this purpose?

Calculating the annualized loss expectancy (ALE)

Reviewing the risk register from the previous year

Brainstorming with plant operators and engineers

Performing a vulnerability scan of the ICS network

Certified Tester Security Tester

Domain 1Objective 3

Analysis of Risk Assessment Techniques CT-SEC Practice Questions (Page 2)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 6–10

6application · medium
A security tester has identified a risk that a legacy authentication system could be exploited, leading to unauthorized access. The organization decides to implement multi-factor authentication (MFA) to reduce the likelihood of exploitation. Which risk treatment strategy is being applied?
Select an answer first
7application · medium
A security tester is performing a risk assessment for a mobile banking app. The tester wants to identify potential threats by examining the app's architecture, data flows, and trust boundaries. Which technique is most suitable?
Select an answer first
8foundation · easy
What is a key characteristic of qualitative risk analysis?
Select an answer first
9application · medium
A security tester is performing a risk assessment for a healthcare organization's patient portal. The tester needs to assign a monetary value to the potential loss if patient records are exposed, and also estimate the annual frequency of such an event. Which risk analysis approach is the tester applying?
Select an answer first
10application · medium
A security tester is conducting a risk assessment for a manufacturing company's industrial control system (ICS). The tester needs to identify potential threats and vulnerabilities. Which technique is most appropriate for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Analysis of Risk Assessment Techniques CT-SEC Practice Questions (Page 2)

Questions 6–10

A security tester has identified a risk that a legacy authentication system could be exploited, leading to unauthorized access. The organization decides to implement multi-factor authentication (MFA) to reduce the likelihood of exploitation. Which risk treatment strategy is being applied?

A security tester is performing a risk assessment for a mobile banking app. The tester wants to identify potential threats by examining the app's architecture, data flows, and trust boundaries. Which technique is most suitable?

What is a key characteristic of qualitative risk analysis?

A security tester is conducting a risk assessment for a manufacturing company's industrial control system (ICS). The tester needs to identify potential threats and vulnerabilities. Which technique is most appropriate for this purpose?

Keep studying — The Basis of Security Testing