During a security assessment, a tester identifies a critical vulnerability in a custom-built internal application. The asset inventory lists the application's owner as 'the development team'. However, the development team lead states that they only built the application and that the 'business owner' is the head of the HR department, who uses the application for employee records. The tester needs to report the vulnerability. Who should the tester primarily engage with to discuss the business impact and risk acceptance?

The tester should not engage with anyone and should just include the finding in the final report.

The CISO, as they are ultimately responsible for all security risks in the organization.

The head of the HR department, as they are the business owner who understands the value and impact of the data.

The development team lead, as they are listed as the owner in the inventory and are responsible for fixing the code.

A mid-sized e-commerce company is preparing for its first external security assessment. The IT manager has a spreadsheet of servers but admits it is outdated. The development team uses a separate list of cloud resources, and the network team has a diagram of the on-premises infrastructure. The security tester needs a complete and accurate view of the attack surface. What is the FIRST step the tester should recommend?

Perform automated network scanning to discover all live hosts and use that as the definitive asset list.

Consolidate the lists from IT, development, and network teams into a single asset inventory, and then verify it against live systems.

Begin the penetration test using the IT manager's spreadsheet as the primary source, as it is the most authoritative.

Ask the CISO to approve a single source of truth, such as the configuration management database (CMDB), and use only that.

A security tester is creating a documentation template for a client's asset inventory. The client wants to ensure the inventory is useful for future security tests and audits. Which of the following fields is MOST important to include to ensure the inventory is actionable for security testing?

The name of the vendor and the support contract number.

The asset's owner, criticality rating, and IP address or hostname.

The asset's purchase date and original cost.

The asset's physical location, such as the building and room number.

Why is it important to assign ownership to assets?

To ensure accountability for the asset's security and maintenance

To automatically approve all changes to the asset

To transfer all security risks to the owner

To eliminate the need for security testing

Certified Tester Security Tester

Domain 1Objective 2

Asset Identification CT-SEC Practice Questions (Page 6)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

9concepts

Questions 26–30

26application · medium
During a security assessment, a tester identifies a critical vulnerability in a custom-built internal application. The asset inventory lists the application's owner as 'the development team'. However, the development team lead states that they only built the application and that the 'business owner' is the head of the HR department, who uses the application for employee records. The tester needs to report the vulnerability. Who should the tester primarily engage with to discuss the business impact and risk acceptance?
Select an answer first
27foundation · easy
If a web application depends on a database server, what is the database server in this relationship?
Select an answer first
28application · medium
A mid-sized e-commerce company is preparing for its first external security assessment. The IT manager has a spreadsheet of servers but admits it is outdated. The development team uses a separate list of cloud resources, and the network team has a diagram of the on-premises infrastructure. The security tester needs a complete and accurate view of the attack surface. What is the FIRST step the tester should recommend?
Select an answer first
29application · medium
A security tester is creating a documentation template for a client's asset inventory. The client wants to ensure the inventory is useful for future security tests and audits. Which of the following fields is MOST important to include to ensure the inventory is actionable for security testing?
Select an answer first
30foundation · easy
Why is it important to assign ownership to assets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Asset Identification CT-SEC Practice Questions (Page 6)

Questions 26–30

If a web application depends on a database server, what is the database server in this relationship?

A security tester is creating a documentation template for a client's asset inventory. The client wants to ensure the inventory is useful for future security tests and audits. Which of the following fields is MOST important to include to ensure the inventory is actionable for security testing?

Why is it important to assign ownership to assets?

Keep studying — The Basis of Security Testing