A security tester is documenting the security testing needs for a system that will be developed using an agile methodology. The documentation must be updated frequently. What is the best way to maintain the documentation?

Document only the final testing needs after development is complete.

Create a static document at the start of the project and do not change it.

Maintain a living document that is updated at the end of each sprint.

Use a wiki that anyone can edit without review.

A security tester is analyzing the security testing needs for a system that will be deployed in a hybrid cloud environment. The system handles both public and confidential data. The organization has limited testing budget. What is the most effective way to prioritize testing needs?

Prioritize testing based on the sensitivity of the data and the exposure of each component.

Focus testing on the public cloud components because they are more exposed.

Test all components equally to ensure comprehensive coverage.

Defer all testing until after deployment to save costs.

When analyzing security testing needs for an internal HR system, which factor is MOST relevant to determining the level of security testing required?

The age of the hardware running the system

The number of features in the system

The sensitivity of the data processed

The system's user interface design

A security tester is analyzing the security testing needs for a system that will be accessible via both web and mobile interfaces. The system handles financial transactions. The organization has a limited testing team. What is the most efficient way to define the testing needs?

Identify common security requirements and test them once, then add interface-specific tests.

Focus on the mobile interface because it is more popular.

Test the backend services only, as they are the most critical.

Test the web interface thoroughly and assume the mobile interface is similar.

What is the PRIMARY purpose of documenting security testing needs in a structured and traceable manner?

To provide a record for legal proceedings

To satisfy the requirements of the development team

To ensure that all stakeholders understand and can verify what will be tested and why

To replace the need for a separate test plan

Certified Tester Security Tester

Domain 8Objective 2

Analyzing and Documenting Security Testing Needs CT-SEC Practice Questions (Page 3)

Part of the Security Testing Tools domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

2concepts

Questions 11–15

11expert · hard
A security tester is documenting the security testing needs for a system that will be developed using an agile methodology. The documentation must be updated frequently. What is the best way to maintain the documentation?
Select an answer first
12expert · hard
A security tester is analyzing the security testing needs for a system that will be deployed in a hybrid cloud environment. The system handles both public and confidential data. The organization has limited testing budget. What is the most effective way to prioritize testing needs?
Select an answer first
13foundation · easy
When analyzing security testing needs for an internal HR system, which factor is MOST relevant to determining the level of security testing required?
Select an answer first
14expert · hard
A security tester is analyzing the security testing needs for a system that will be accessible via both web and mobile interfaces. The system handles financial transactions. The organization has a limited testing team. What is the most efficient way to define the testing needs?
Select an answer first
15foundation · easy
What is the PRIMARY purpose of documenting security testing needs in a structured and traceable manner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.