A tester has completed a malware scanner evaluation and found that the scanner has a 98% detection rate but a 15% false positive rate. The organization's security team is concerned about alert fatigue. The tester needs to provide a recommendation that balances detection and false positives. What is the most appropriate recommendation?

Replace the scanner with a different product that has a lower false positive rate.

Disable heuristic detection to eliminate false positives.

Deploy the scanner as-is and accept the false positives as a trade-off for high detection.

Tune the scanner to reduce false positives, even if it lowers the detection rate to 95%.

A tester has completed a malware scanner evaluation and needs to document the findings. The scanner had a 95% detection rate and a 2% false positive rate. Which information is most important to include in the report?

The names of the malware samples used in the test.

The names of the testers who ran the evaluation.

The cost of the scanner and the vendor's support plan.

The detection rate, false positive rate, and the test methodology.

After completing a malware scanner evaluation, a tester needs to report the results to management. The scanner had a 99% detection rate but also produced a high number of false positives. What is the most important recommendation to include in the report?

Recommend ignoring false positives because they are less important than detection rate.

Recommend immediate deployment of the scanner because of the high detection rate.

Recommend tuning the scanner's sensitivity settings to balance detection and false positives.

Recommend replacing the scanner with a different product that has a lower false positive rate.

What is the purpose of using a known malware sample set (e.g., from a public repository) when testing a malware scanner?

To validate the scanner's compatibility with the operating system

To test the scanner's performance under load

To ensure the scanner does not produce false positives

To verify the scanner can detect known threats consistently

Certified Tester Security Tester

Domain 5Objective 6

Malware Scanning CT-SEC Practice Questions (Page 2)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 6–10

6expert · hard
A tester has completed a malware scanner evaluation and found that the scanner has a 98% detection rate but a 15% false positive rate. The organization's security team is concerned about alert fatigue. The tester needs to provide a recommendation that balances detection and false positives. What is the most appropriate recommendation?
Select an answer first
7application · medium
A security tester is designing a test to evaluate a malware scanner's detection of trojans. The tester has a set of 100 known trojan samples and 100 benign files. The scanner detects 90 trojans and flags 5 benign files as malicious. What is the scanner's precision?
Select an answer first
8application · medium
A tester has completed a malware scanner evaluation and needs to document the findings. The scanner had a 95% detection rate and a 2% false positive rate. Which information is most important to include in the report?
Select an answer first
9application · medium
After completing a malware scanner evaluation, a tester needs to report the results to management. The scanner had a 99% detection rate but also produced a high number of false positives. What is the most important recommendation to include in the report?
Select an answer first
10foundation · easy
What is the purpose of using a known malware sample set (e.g., from a public repository) when testing a malware scanner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Malware Scanning CT-SEC Practice Questions (Page 2)

Questions 6–10

A security tester is designing a test to evaluate a malware scanner's detection of trojans. The tester has a set of 100 known trojan samples and 100 benign files. The scanner detects 90 trojans and flags 5 benign files as malicious. What is the scanner's precision?

A tester has completed a malware scanner evaluation and needs to document the findings. The scanner had a 95% detection rate and a 2% false positive rate. Which information is most important to include in the report?

After completing a malware scanner evaluation, a tester needs to report the results to management. The scanner had a 99% detection rate but also produced a high number of false positives. What is the most important recommendation to include in the report?

What is the purpose of using a known malware sample set (e.g., from a public repository) when testing a malware scanner?

Keep studying — Testing Security Mechanisms