A security tester is conducting an assessment for a large enterprise. The asset inventory is comprehensive but lists the 'owner' of a critical financial reporting system as 'IT Operations'. However, the IT Operations team states they only manage the infrastructure (servers, OS) and do not own the application or its data. The actual business owner is the CFO's office. The tester discovers a critical vulnerability in the application. What is the MOST significant challenge this ownership ambiguity creates for the security test?

The tester will be unable to determine the criticality of the asset without the correct owner.

The tester may struggle to get a decision on risk acceptance and remediation priorities because the accountable party is unclear.

The tester will have to re-do the entire asset inventory to correct the ownership information.

The tester will not know which technical team to contact to fix the vulnerability.

Why is the disposal stage of the asset lifecycle relevant to security testing?

To assign a new owner to the asset

To classify the asset for the first time

To ensure data is securely erased before the asset is retired

To test the asset's performance under load

Which of the following is an example of reputational impact in asset value assessment?

Downtime of a critical application

Loss of customer trust due to a data breach

Cost of replacing a damaged server

What is the primary purpose of the asset identification process in security testing?

To determine which assets are most vulnerable to attack

To systematically discover and document all assets within the organization's scope

To prioritize assets based on their criticality to business operations

To assign monetary values to all assets for insurance purposes

Which of the following is a common criterion used to classify assets?

The asset's sensitivity to confidentiality and integrity

The asset's color or physical appearance

Certified Tester Security Tester

Domain 1Objective 2

Asset Identification CT-SEC Practice Questions (Page 4)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 16–20

16expert · hard
A security tester is conducting an assessment for a large enterprise. The asset inventory is comprehensive but lists the 'owner' of a critical financial reporting system as 'IT Operations'. However, the IT Operations team states they only manage the infrastructure (servers, OS) and do not own the application or its data. The actual business owner is the CFO's office. The tester discovers a critical vulnerability in the application. What is the MOST significant challenge this ownership ambiguity creates for the security test?
Select an answer first
17foundation · easy
Why is the disposal stage of the asset lifecycle relevant to security testing?
Select an answer first
18foundation · easy
Which of the following is an example of reputational impact in asset value assessment?
Select an answer first
19foundation · easy
What is the primary purpose of the asset identification process in security testing?
Select an answer first
20foundation · easy
Which of the following is a common criterion used to classify assets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.