A security test team is working on a project for a client that must comply with both PCI DSS and the OWASP ASVS. The client has a limited budget and wants to minimize testing effort while still meeting both standards. The test lead is deciding how to structure the test plan. What is the most efficient approach?

Run all PCI DSS tests first, then run all ASVS tests, and combine the results in the final report

Use only ASVS because it is more comprehensive than PCI DSS

Use only PCI DSS because it is a regulatory requirement and ASVS is optional

Identify the overlapping requirements between PCI DSS and ASVS and create a single test case for each unique requirement

When applying the OWASP Testing Guide to a web application security test, which of the following activities is directly aligned with the guide's recommendations?

Configuring a firewall to block malicious traffic

Reviewing the application's source code for SQL injection vulnerabilities

Testing the application's authentication and session management mechanisms

Performing a network vulnerability scan using a commercial tool

A security tester is working on a project for a client that requires testing to be aligned with a framework that covers both management and technical controls. The client wants a single framework that can be used to assess the overall security posture. Which framework is most appropriate?

NIST Cybersecurity Framework (CSF)

Certified Tester Security Tester

Domain 9Objective 4

Applying Security Standards CT-SEC Practice Questions (Page 4)

Part of the Standards and Industry Trends domain, which makes up ~11% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

3concepts

Questions 16–20

16foundation · easy
Which of the following is a security standard that provides a framework for managing information security risks and is commonly referenced in software testing to align with organizational security policies?
Select an answer first
17expert · hard
A security test team is working on a project for a client that must comply with both PCI DSS and the OWASP ASVS. The client has a limited budget and wants to minimize testing effort while still meeting both standards. The test lead is deciding how to structure the test plan. What is the most efficient approach?
Select an answer first
18foundation · easy
When applying the OWASP Testing Guide to a web application security test, which of the following activities is directly aligned with the guide's recommendations?
Select an answer first
19application · medium
A security tester is working on a project for a client that requires testing to be aligned with a framework that covers both management and technical controls. The client wants a single framework that can be used to assess the overall security posture. Which framework is most appropriate?
Select an answer first
20foundation · easy
Which framework is specifically designed to guide the development of secure software by providing a set of security requirements and best practices for each phase of the software development lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Applying Security Standards CT-SEC Practice Questions (Page 4)

Questions 16–20

Which of the following is a security standard that provides a framework for managing information security risks and is commonly referenced in software testing to align with organizational security policies?

When applying the OWASP Testing Guide to a web application security test, which of the following activities is directly aligned with the guide's recommendations?

A security tester is working on a project for a client that requires testing to be aligned with a framework that covers both management and technical controls. The client wants a single framework that can be used to assess the overall security posture. Which framework is most appropriate?

Which framework is specifically designed to guide the development of secure software by providing a set of security requirements and best practices for each phase of the software development lifecycle?

Keep studying — Standards and Industry Trends