A security tester has completed the analysis of a system's security testing needs. The results must be shared with both technical and non-technical stakeholders. What is the most effective way to document these needs?

Email a list of security testing activities to the project manager.

Store the analysis in a shared folder without a formal structure.

Prepare a structured document with an executive summary, risk-based priorities, and traceable links to requirements.

Create a single detailed technical report with all findings and recommendations.

A security tester is documenting the security testing needs for a system that is subject to multiple compliance frameworks. What is the best way to ensure the documentation is traceable?

List all compliance frameworks in a separate appendix.

Include a summary of the organization's security policy.

Create a mapping between each compliance requirement and the corresponding test case.

Describe the testing tools used for each framework.

A company is developing an Internet of Things (IoT) device that collects health data. The security team needs to determine the security testing needs. Which factor is most critical to consider in this analysis?

The cost of the device to the end user.

The regulatory requirements for health data protection and the device's attack surface.

The device's battery life and processing power.

The color and design of the device casing.

A security tester is analyzing the security testing needs for a legacy system that is being integrated with a modern cloud-based service. The legacy system has known vulnerabilities that cannot be patched easily. The integration must be completed within a tight deadline. What is the best approach?

Identify the risks introduced by the integration and focus testing on the integration points and compensating controls.

Test only the cloud service, assuming the legacy system is already secure.

Refuse to integrate until all legacy vulnerabilities are fixed.

Perform a full security test on the integrated system after the deadline.

A security tester is documenting the security testing needs for a system that must comply with both GDPR and PCI DSS. The documentation will be reviewed by auditors from both domains. What is the best way to structure the documentation to satisfy both?

Focus on GDPR requirements and mention PCI DSS in a footnote.

Use a single document with a traceability matrix that maps each requirement to the relevant framework.

List all testing activities without linking them to specific requirements.

Create separate documents for each compliance framework.

Certified Tester Security Tester

Domain 8Objective 2

Analyzing and Documenting Security Testing Needs CT-SEC Practice Questions (Page 2)

Part of the Security Testing Tools domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

2concepts

Questions 6–10

6application · medium
A security tester has completed the analysis of a system's security testing needs. The results must be shared with both technical and non-technical stakeholders. What is the most effective way to document these needs?
Select an answer first
7application · medium
A security tester is documenting the security testing needs for a system that is subject to multiple compliance frameworks. What is the best way to ensure the documentation is traceable?
Select an answer first
8application · medium
A company is developing an Internet of Things (IoT) device that collects health data. The security team needs to determine the security testing needs. Which factor is most critical to consider in this analysis?
Select an answer first
9expert · hard
A security tester is analyzing the security testing needs for a legacy system that is being integrated with a modern cloud-based service. The legacy system has known vulnerabilities that cannot be patched easily. The integration must be completed within a tight deadline. What is the best approach?
Select an answer first
10expert · hard
A security tester is documenting the security testing needs for a system that must comply with both GDPR and PCI DSS. The documentation will be reviewed by auditors from both domains. What is the best way to structure the documentation to satisfy both?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.