During the design phase of a new payment system, the team is deciding on the architecture. Which security activity is most appropriate at this stage?

Perform threat modeling to identify potential attack vectors and design mitigations

Review the application's error logs for security incidents

Run a vulnerability scan on the production servers

Execute penetration tests against the application's API endpoints

An organization wants to implement continuous security testing in its CI/CD pipeline. Which practice best supports this goal?

Review security requirements only at the start of the project

Perform manual security testing only when a major feature is added

Schedule a penetration test once a year after the release

Automate static application security testing (SAST) to run on every code commit

Why is security testing considered a lifecycle activity rather than a single phase?

Because security risks and requirements evolve throughout the lifecycle and need continuous attention.

Because security testing is only relevant during maintenance when patches are applied.

Because security testing can only be performed after the system is fully integrated.

Because security testing is a regulatory requirement that must be completed in one phase.

Certified Tester Security Tester

Domain 4Objective 1

Lifecycle Overview CT-SEC Practice Questions (Page 3)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

Questions 11–15

11application · medium
During the design phase of a new payment system, the team is deciding on the architecture. Which security activity is most appropriate at this stage?
Select an answer first
12application · medium
An organization wants to implement continuous security testing in its CI/CD pipeline. Which practice best supports this goal?
Select an answer first
13foundation · easy
Why is security testing considered a lifecycle activity rather than a single phase?
Select an answer first
14foundation · easy
Which role is primarily responsible for performing static analysis and secure code reviews during development?
Select an answer first
15foundation · easy
Which stakeholder is most likely to lead threat modeling during the design phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Lifecycle Overview CT-SEC Practice Questions (Page 3)

Questions 11–15

During the design phase of a new payment system, the team is deciding on the architecture. Which security activity is most appropriate at this stage?

An organization wants to implement continuous security testing in its CI/CD pipeline. Which practice best supports this goal?

Why is security testing considered a lifecycle activity rather than a single phase?

Which role is primarily responsible for performing static analysis and secure code reviews during development?

Which stakeholder is most likely to lead threat modeling during the design phase?

Keep studying — Security Testing Throughout the Software Lifecycle