A security tester is looking for a framework that provides a structured approach to penetration testing, including pre-engagement, engagement, and post-engagement phases. Which standard or framework is most appropriate?

PTES (Penetration Testing Execution Standard)

A security test team is testing a web application for a client that requires compliance with the OWASP Top 10. The team has completed the testing and is preparing the final report. What is the most appropriate way to present the findings to demonstrate alignment with the OWASP Top 10?

List all vulnerabilities in alphabetical order without categorization

Map each identified vulnerability to the corresponding OWASP Top 10 category

Only include vulnerabilities that were successfully exploited

Present findings in a separate document from the test methodology

A security test team is working on a project that must comply with both ISO/IEC 27001 and the OWASP ASVS. The project manager wants to streamline the test plan to avoid duplication. What is the most effective approach?

Use only ISO/IEC 27001 and drop ASVS because ISO covers all security aspects

Use ISO/IEC 27001 to define the overall security management framework and ASVS for detailed application-level verification

Create a separate test plan for each standard and run them independently

Use only ASVS and drop ISO because ASVS is more technical and thorough

A security tester is planning the test approach for a new application. The organization has adopted the NIST Cybersecurity Framework (CSF) as its primary security framework. The tester needs to align the test plan with the CSF. Which testing activity aligns with the 'Detect' function of the CSF?

Testing the business impact analysis process

Testing the effectiveness of security monitoring and alerting mechanisms

Testing the implementation of access control policies

Testing the application's ability to recover from a ransomware attack

Certified Tester Security Tester

Domain 9Objective 4

Applying Security Standards CT-SEC Practice Questions (Page 1)

Part of the Standards and Industry Trends domain, which makes up ~11% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

3concepts

Questions 1–5

1application · medium
A security tester is looking for a framework that provides a structured approach to penetration testing, including pre-engagement, engagement, and post-engagement phases. Which standard or framework is most appropriate?
Select an answer first
2application · medium
A security test team is testing a web application for a client that requires compliance with the OWASP Top 10. The team has completed the testing and is preparing the final report. What is the most appropriate way to present the findings to demonstrate alignment with the OWASP Top 10?
Select an answer first
3expert · hard
A security test team is working on a project that must comply with both ISO/IEC 27001 and the OWASP ASVS. The project manager wants to streamline the test plan to avoid duplication. What is the most effective approach?
Select an answer first
4application · medium
A security tester is selecting a standard to guide the testing of a new API that will be used by external partners. The API will handle sensitive business data. The tester wants a standard that provides specific security testing requirements for APIs. Which standard is most appropriate?
Select an answer first
5application · medium
A security tester is planning the test approach for a new application. The organization has adopted the NIST Cybersecurity Framework (CSF) as its primary security framework. The tester needs to align the test plan with the CSF. Which testing activity aligns with the 'Detect' function of the CSF?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.