A startup is developing a new mobile app and has limited budget for security testing. The CEO wants to ensure that the app is secure but is unsure how to prioritize security testing efforts. Which approach best aligns security testing with the organization's business objectives?

Hire an external consultant to test the app after launch

Perform a full penetration test on every feature, regardless of risk

Conduct a risk assessment to identify the most critical assets and focus testing on those areas

Skip security testing until the app is released and user feedback is received

A security tester is evaluating a new cloud-based application that will store sensitive customer data. The organization has a business objective to minimize costs, but also has a regulatory requirement to protect data at rest and in transit. The tester must decide which security testing activities to prioritize. Which approach best balances cost and regulatory requirements?

Skip security testing until after the application is deployed to save money.

Conduct a full penetration test on all features, regardless of risk, to ensure complete coverage.

Rely solely on automated vulnerability scanning to reduce costs.

Perform a risk assessment to identify the most critical data flows and focus security testing on those areas, ensuring encryption and access controls are tested.

Which of the following is a primary goal of security testing?

To optimize the software's performance under high load conditions.

To ensure the software is user-friendly and intuitive.

To verify that the software meets all functional requirements.

To identify vulnerabilities and assess the associated risks to the organization.

A government agency is developing a new system that will handle classified information. The agency's security policy requires that all security testing be performed by cleared personnel and that the testing environment be isolated from the production network. Which organizational factor is most directly influencing the security testing approach?

The budget allocated for security testing

The agency's security policies and procedures

The availability of security testing tools

The technical complexity of the system

A healthcare organization is preparing to launch a patient portal that will handle sensitive personal health information. The compliance team has mandated that security testing must demonstrate that the portal protects patient data confidentiality and integrity. The project manager asks the security tester to focus on finding vulnerabilities that could lead to unauthorized access or data tampering. Which primary goal of security testing is the team emphasizing?

Identifying vulnerabilities that could compromise confidentiality and integrity

Ensuring the portal meets all functional requirements

Validating that the portal is user-friendly and accessible

Confirming that the portal can handle the expected load

Certified Tester Security Tester

Domain 2Objective 1

Foundations of Security Testing CT-SEC Practice Questions (Page 1)

Part of the Security Testing Purposes, Goals and Strategies domain, which makes up ~7% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

Questions 1–5

1application · medium
A startup is developing a new mobile app and has limited budget for security testing. The CEO wants to ensure that the app is secure but is unsure how to prioritize security testing efforts. Which approach best aligns security testing with the organization's business objectives?
Select an answer first
2expert · hard
A security tester is evaluating a new cloud-based application that will store sensitive customer data. The organization has a business objective to minimize costs, but also has a regulatory requirement to protect data at rest and in transit. The tester must decide which security testing activities to prioritize. Which approach best balances cost and regulatory requirements?
Select an answer first
3foundation · easy
Which of the following is a primary goal of security testing?
Select an answer first
4application · medium
A government agency is developing a new system that will handle classified information. The agency's security policy requires that all security testing be performed by cleared personnel and that the testing environment be isolated from the production network. Which organizational factor is most directly influencing the security testing approach?
Select an answer first
5application · medium
A healthcare organization is preparing to launch a patient portal that will handle sensitive personal health information. The compliance team has mandated that security testing must demonstrate that the portal protects patient data confidentiality and integrity. The project manager asks the security tester to focus on finding vulnerabilities that could lead to unauthorized access or data tampering. Which primary goal of security testing is the team emphasizing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Foundations of Security Testing CT-SEC Practice Questions (Page 1)

Questions 1–5

A startup is developing a new mobile app and has limited budget for security testing. The CEO wants to ensure that the app is secure but is unsure how to prioritize security testing efforts. Which approach best aligns security testing with the organization's business objectives?

Which of the following is a primary goal of security testing?

Keep studying — Security Testing Purposes, Goals and Strategies