An interim security test report lists a medium-severity vulnerability in a public-facing API that could lead to data exposure. The system is a critical infrastructure component. The test lead must decide how to prioritize this finding against a high-severity vulnerability in an internal tool that is not exposed to the internet. What is the most appropriate prioritization?

Treat both vulnerabilities equally because both are security issues that need to be fixed.

Prioritize the medium-severity public API vulnerability because it is exposed to the internet and could lead to data exposure.

Prioritize the internal tool vulnerability because it is high severity and could lead to lateral movement.

Prioritize the high-severity internal tool vulnerability because it is rated higher in severity.

In an interim security test status report, a finding is classified as 'high severity'. What does this imply about the finding?

It is a false positive and does not require any action

It only affects the test environment and not the production system

It has a significant potential impact on the system and should be prioritized for follow-up

It is a minor issue that can be ignored until the final report

A security test status report shows that 50 test cases were executed, 30 passed, 10 failed, and 10 were blocked. What is the most accurate interpretation of this data?

There are 10 failed tests that need investigation and 10 blocked tests that need unblocking to complete testing

The system is secure because 30 tests passed

Testing is 100% complete and all issues are resolved

The test plan is invalid because of the blocked tests

During interim testing, a critical vulnerability is discovered. What is the most appropriate action regarding the risk assessment?

Increase the risk level for the affected component

Keep the risk level unchanged until all testing is complete

Decrease the risk level because the vulnerability was found

Remove the component from the risk assessment

Certified Tester Security Tester

Domain 7Objective 3

Analyzing Interim Security Test Status Reports CT-SEC Practice Questions (Page 4)

Part of the Security Test Evaluation and Reporting domain, which makes up ~6% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

Questions 16–20

16expert · hard
An interim security test report lists a medium-severity vulnerability in a public-facing API that could lead to data exposure. The system is a critical infrastructure component. The test lead must decide how to prioritize this finding against a high-severity vulnerability in an internal tool that is not exposed to the internet. What is the most appropriate prioritization?
Select an answer first
17foundation · easy
In an interim security test status report, a finding is classified as 'high severity'. What does this imply about the finding?
Select an answer first
18foundation · easy
A security test status report shows that 50 test cases were executed, 30 passed, 10 failed, and 10 were blocked. What is the most accurate interpretation of this data?
Select an answer first
19foundation · easy
In an interim security test status report, which section would typically describe the number of test cases executed and the number remaining?
Select an answer first
20foundation · easy
During interim testing, a critical vulnerability is discovered. What is the most appropriate action regarding the risk assessment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Analyzing Interim Security Test Status Reports CT-SEC Practice Questions (Page 4)

Questions 16–20

In an interim security test status report, a finding is classified as 'high severity'. What does this imply about the finding?

A security test status report shows that 50 test cases were executed, 30 passed, 10 failed, and 10 were blocked. What is the most accurate interpretation of this data?

In an interim security test status report, which section would typically describe the number of test cases executed and the number remaining?

During interim testing, a critical vulnerability is discovered. What is the most appropriate action regarding the risk assessment?

Keep studying — Security Test Evaluation and Reporting