A security testing team is planning to test a web application that is hosted in a cloud environment. The application uses a third-party authentication service. The team wants to test the authentication and authorization mechanisms. What should they consider?

Rely on the third-party service's security certifications

Test only the application's own authentication code

Test only the authorization logic, assuming the third-party service is secure

Test the integration with the third-party service and the application's authorization logic

A security testing team has been using the same set of tools for several years. They notice that the tools are missing vulnerabilities that are being found by other organizations. What should they do to improve their testing capabilities?

Continue using the same tools to maintain consistency

Evaluate and incorporate new tools and techniques

Reduce the number of tools to simplify the process

Rely on manual testing instead of tools

After a security assessment, the testing team provides a long list of findings to the development team. The developers are overwhelmed and do not know which issues to fix first. What should the security team do to improve the remediation process?

Require developers to fix all findings within one sprint

Prioritize findings based on risk and provide clear remediation guidance

Let the project manager decide the order of fixes

Send the raw scan report directly to the developers

A security testing team is planning a penetration test for a financial application. The test must comply with regulatory requirements that mandate specific testing methods and reporting. The team wants to be efficient and avoid duplicating efforts. What should they do first?

Review the regulatory requirements and align the test plan accordingly

Use a generic test plan from a previous project

Delegate the planning to a junior tester

Start testing immediately to save time

A security testing team is planning a test for a web application that is hosted in a cloud environment. The team has access to the application's source code and the cloud console. They want to test for vulnerabilities that are unique to the cloud deployment, such as misconfigured storage buckets and overly permissive IAM roles. Which testing approach would be most effective?

Rely on the cloud provider's security assessments

Test only the application's business logic

Perform a static analysis of the source code

Review the cloud configuration and perform dynamic testing of the application

Certified Tester Security Tester

Domain 2Objective 4

Improving Security Testing Practices CT-SEC Practice Questions (Page 2)

Part of the Security Testing Purposes, Goals and Strategies domain, which makes up ~7% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

1concept

Questions 6–10

6expert · hard
A security testing team is planning to test a web application that is hosted in a cloud environment. The application uses a third-party authentication service. The team wants to test the authentication and authorization mechanisms. What should they consider?
Select an answer first
7application · medium
A security testing team has been using the same set of tools for several years. They notice that the tools are missing vulnerabilities that are being found by other organizations. What should they do to improve their testing capabilities?
Select an answer first
8application · medium
After a security assessment, the testing team provides a long list of findings to the development team. The developers are overwhelmed and do not know which issues to fix first. What should the security team do to improve the remediation process?
Select an answer first
9expert · hard
A security testing team is planning a penetration test for a financial application. The test must comply with regulatory requirements that mandate specific testing methods and reporting. The team wants to be efficient and avoid duplicating efforts. What should they do first?
Select an answer first
10expert · hard
A security testing team is planning a test for a web application that is hosted in a cloud environment. The team has access to the application's source code and the cloud console. They want to test for vulnerabilities that are unique to the cloud deployment, such as misconfigured storage buckets and overly permissive IAM roles. Which testing approach would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.