Which role should typically have access to the full security test report?

All employees in the organization

The security tester who performed the assessment

Which legal or regulatory requirement may govern the confidentiality of security test results?

Data protection regulations such as GDPR or HIPAA

A security testing firm has completed a penetration test for a client. The client's marketing department wants to use the test results in a press release to demonstrate their commitment to security. The client's legal team has approved the release. What should the firm do?

Refuse to provide any information to the marketing department.

Provide the full test results to the marketing department for the press release.

Provide the test results to the marketing department and let them decide what to include.

Provide a sanitized summary of the test results that highlights the security improvements without revealing vulnerabilities.

A security tester is working remotely and needs to access the test results stored on the company's internal server. What is the MOST secure way to access the results?

Use a VPN to connect to the company network before accessing the results.

Access the results directly over the internet without any additional security.

Email the results to the tester's personal email address.

Use a file-sharing service that is not approved by the company.

After a security assessment, the tester needs to present findings to a group of stakeholders that includes both technical staff and non-technical executives. What is the BEST approach to communicate the results?

Send the full report via email to all stakeholders without any explanation.

Create two versions: a detailed technical report for the technical team and a high-level summary for executives.

Verbally present the findings without any written documentation.

Provide a single detailed technical report to all stakeholders.

Certified Tester Security Tester

Domain 7Objective 2

Confidentiality of Security Test Results CT-SEC Practice Questions (Page 2)

Part of the Security Test Evaluation and Reporting domain, which makes up ~6% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

5concepts

Questions 6–10

6foundation · easy
Which role should typically have access to the full security test report?
Select an answer first
7foundation · easy
Which legal or regulatory requirement may govern the confidentiality of security test results?
Select an answer first
8expert · hard
A security testing firm has completed a penetration test for a client. The client's marketing department wants to use the test results in a press release to demonstrate their commitment to security. The client's legal team has approved the release. What should the firm do?
Select an answer first
9application · medium
A security tester is working remotely and needs to access the test results stored on the company's internal server. What is the MOST secure way to access the results?
Select an answer first
10application · medium
After a security assessment, the tester needs to present findings to a group of stakeholders that includes both technical staff and non-technical executives. What is the BEST approach to communicate the results?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.