Certified Tester Security Tester
Domain 5Objective 2
Authentication and Authorization CT-SEC Practice Questions (Page 2)
Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)
33questions here
7free pages
10concepts
Questions 6–10
- 6
A security tester is reviewing an application's authentication mechanism. The application requires users to provide a password and a one-time code sent to their mobile device. Which authentication mechanism is being used?
Select an answer first - 7
A security tester logs into an application using the username 'admin' and the password 'admin'. Which authentication weakness is being exploited?
Select an answer first - 8
Which authorization model makes access decisions based on attributes such as user department, resource classification, and time of day?
Select an answer first - 9
A tester analyzes how the application handles session tokens, including their generation, expiration, and transmission. Which security testing technique is this?
Select an answer first - 10
Which of the following is a biometric authentication mechanism?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.