Which practice is appropriate when storing security test results?

Printing them and leaving them on a shared printer

Encrypting the files and restricting access to authorized personnel only

Storing them in a shared folder with read access for all employees

Keeping them only in the tester's local unencrypted drive

A security testing team has completed an assessment and stored the results in a shared repository. The team lead wants to ensure that only the testers and the project manager can access the results, but also wants to allow the client's security team to view the results for review. What is the BEST approach?

Grant the client's security team full access to the repository.

Create a separate group for the client's security team and grant them read-only access to the repository.

Share the results with the client's security team via email.

Do not allow the client's security team to access the results.

A security tester has completed an assessment and is about to send the results to the client. The tester accidentally sends the results to the wrong email address. What should the tester do FIRST?

Report the incident to the client and the tester's supervisor immediately.

Try to recall the email using the email system's recall feature.

Contact the recipient and ask them to delete the email.

Do nothing and hope the recipient does not read the email.

A security tester has completed an assessment and needs to dispose of the test results after the project is closed. What is the MOST appropriate method of disposal?

Keep the files indefinitely in case they are needed later.

Overwrite the files with random data once.

Move the files to the recycle bin and empty it.

Securely delete the files and wipe the storage media.

What is the purpose of sanitizing security test results before sharing them with a broader audience?

To make the report longer and more detailed

To remove sensitive details that could be exploited if the report is leaked

To convert the report to a different file format

To ensure the report is grammatically correct

Certified Tester Security Tester

Domain 7Objective 2

Confidentiality of Security Test Results CT-SEC Practice Questions (Page 1)

Part of the Security Test Evaluation and Reporting domain, which makes up ~6% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

5concepts

Questions 1–5

1foundation · easy
Which practice is appropriate when storing security test results?
Select an answer first
2expert · hard
A security testing team has completed an assessment and stored the results in a shared repository. The team lead wants to ensure that only the testers and the project manager can access the results, but also wants to allow the client's security team to view the results for review. What is the BEST approach?
Select an answer first
3expert · hard
A security tester has completed an assessment and is about to send the results to the client. The tester accidentally sends the results to the wrong email address. What should the tester do FIRST?
Select an answer first
4application · medium
A security tester has completed an assessment and needs to dispose of the test results after the project is closed. What is the MOST appropriate method of disposal?
Select an answer first
5foundation · easy
What is the purpose of sanitizing security test results before sharing them with a broader audience?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.