Which strategy is most effective for improving the efficiency of security testing in an organization with limited resources?

Performing all security tests manually to avoid tool configuration overhead

Increasing the frequency of security tests without adjusting scope

Prioritizing security tests based on risk and business impact

Outsourcing all security testing to an external vendor

A security testing team is responsible for testing a web application that handles sensitive customer data. The application is deployed in a cloud environment, and the team has access to the source code and the running application. They need to identify vulnerabilities that are specific to the cloud deployment, such as misconfigured storage and identity issues. Which testing approach would be most effective?

Rely on the cloud provider's security certifications

Conduct a dynamic test of the running application and review cloud configuration

Test only the application's business logic

Perform a static analysis of the source code only

A security testing team is asked to test a new application that is being developed using a microservices architecture. The team has limited experience with this architecture. They need to ensure that the testing is thorough and covers the interactions between services. What is the best approach?

Focus on testing the API gateway and assume the services are secure

Test each microservice in isolation

Perform end-to-end testing that includes service-to-service communication

Use only automated tools without manual review

A security testing team is planning to test a legacy system that is critical to business operations. The system cannot be taken offline for testing. What is the best approach to test this system?

Create a replica of the system and test the replica

Skip testing the system because it is too risky

Perform testing in a production environment during off-peak hours

Test only the non-critical components of the system

A security testing team is conducting a test of a critical infrastructure system. The test must not disrupt operations, but the team needs to test the system's response to a denial-of-service attack. What is the best approach?

Perform a full DoS attack on the production system

Simulate a DoS attack in a test environment that mirrors production

Skip DoS testing to avoid any risk

Test DoS only on non-critical components

Certified Tester Security Tester

Domain 2Objective 4

Improving Security Testing Practices CT-SEC Practice Questions (Page 3)

Part of the Security Testing Purposes, Goals and Strategies domain, which makes up ~7% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

1concept

Questions 11–15

11foundation · easy
Which strategy is most effective for improving the efficiency of security testing in an organization with limited resources?
Select an answer first
12expert · hard
A security testing team is responsible for testing a web application that handles sensitive customer data. The application is deployed in a cloud environment, and the team has access to the source code and the running application. They need to identify vulnerabilities that are specific to the cloud deployment, such as misconfigured storage and identity issues. Which testing approach would be most effective?
Select an answer first
13expert · hard
A security testing team is asked to test a new application that is being developed using a microservices architecture. The team has limited experience with this architecture. They need to ensure that the testing is thorough and covers the interactions between services. What is the best approach?
Select an answer first
14application · medium
A security testing team is planning to test a legacy system that is critical to business operations. The system cannot be taken offline for testing. What is the best approach to test this system?
Select an answer first
15expert · hard
A security testing team is conducting a test of a critical infrastructure system. The test must not disrupt operations, but the team needs to test the system's response to a denial-of-service attack. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.