A company is adopting a DevSecOps culture. They want to ensure that security is a shared responsibility across the team. Which practice best supports this goal?

Use only automated security tools without human oversight

Limit security activities to the testing phase

Create a separate security team that handles all security testing

Provide security training to developers and testers so they can perform basic security tasks

A project manager wants to reduce the cost of fixing security defects. The team currently performs security testing only after the application is fully developed. Which approach would best address this concern?

Increase the number of penetration tests performed after deployment

Hire more security testers to perform manual code reviews during the testing phase

Introduce security testing activities in each phase of the software development lifecycle

Deploy a web application firewall to block attacks in production

A security specialist is asked to help a development team integrate security testing into their agile process. Which action best aligns with the specialist's role?

Take over all security testing tasks from the team

Provide guidance on security requirements and review test cases for security coverage

Only perform security testing after the sprint is complete

Focus solely on penetration testing in the production environment

During the development phase, a developer discovers a potential security flaw in a new authentication module. According to the lifecycle roles, what is the developer's primary responsibility in this situation?

Fix the flaw and write a unit test that verifies the fix

Report the flaw to the security specialist and wait for instructions

Document the flaw in the release notes and continue development

Conduct a full penetration test of the application to assess the impact

A company is developing a mobile banking app. They have a tight budget and want to minimize the cost of fixing security defects. Currently, security testing is performed only after the app is fully developed. Which strategy would be most cost-effective?

Perform a single comprehensive penetration test after development is complete

Use only automated security tools during the testing phase

Defer security testing until after the app is released to save budget

Integrate security testing into each development phase, including requirements and design

Certified Tester Security Tester

Domain 4Objective 1

Lifecycle Overview CT-SEC Practice Questions (Page 4)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

Questions 16–20

16expert · hard
A company is adopting a DevSecOps culture. They want to ensure that security is a shared responsibility across the team. Which practice best supports this goal?
Select an answer first
17application · medium
A project manager wants to reduce the cost of fixing security defects. The team currently performs security testing only after the application is fully developed. Which approach would best address this concern?
Select an answer first
18application · medium
A security specialist is asked to help a development team integrate security testing into their agile process. Which action best aligns with the specialist's role?
Select an answer first
19application · medium
During the development phase, a developer discovers a potential security flaw in a new authentication module. According to the lifecycle roles, what is the developer's primary responsibility in this situation?
Select an answer first
20expert · hard
A company is developing a mobile banking app. They have a tight budget and want to minimize the cost of fixing security defects. Currently, security testing is performed only after the app is fully developed. Which strategy would be most cost-effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.