What configuration setting is essential when deploying a malware scanner to test network shares?

Configuring the scanner to use a proxy server

Disabling the scan of compressed files

Setting the scanner to scan mapped network drives

A security tester is evaluating a malware scanner's ability to detect zero-day malware. The tester has a set of known malware samples but no zero-day samples. What is the most appropriate way to simulate zero-day malware for the test?

Disable the scanner's signature database and test only heuristics.

Use benign files that are packed with a common packer.

Use the known malware samples as-is, since they are representative of real threats.

Modify the known malware samples using obfuscation techniques to create new variants.

What is the primary function of YARA in malware analysis?

Performing vulnerability scanning of web applications

Identifying and classifying malware based on custom rules

Encrypting files to protect them from malware

Capturing network traffic for forensic analysis

How is the detection rate of a malware scanner calculated from scan results?

Number of clean files flagged divided by total clean files

Number of false positives divided by total files scanned

Number of detected malware samples divided by total malware samples

Number of scans completed divided by total scans attempted

A security tester needs to scan a web application for malware that might be injected into uploaded files. The tester wants to use a tool that can be integrated into the application's upload process. Which type of tool is most appropriate?

A network intrusion detection system (IDS)

A web application firewall (WAF)

An API-based malware scanning service that can be called from the application.

A vulnerability scanner that checks for OWASP Top 10 issues.

Certified Tester Security Tester

Domain 5Objective 6

Malware Scanning CT-SEC Practice Questions (Page 4)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 16–20

16foundation · easy
What configuration setting is essential when deploying a malware scanner to test network shares?
Select an answer first
17expert · hard
A security tester is evaluating a malware scanner's ability to detect zero-day malware. The tester has a set of known malware samples but no zero-day samples. What is the most appropriate way to simulate zero-day malware for the test?
Select an answer first
18foundation · easy
What is the primary function of YARA in malware analysis?
Select an answer first
19foundation · easy
How is the detection rate of a malware scanner calculated from scan results?
Select an answer first
20application · medium
A security tester needs to scan a web application for malware that might be injected into uploaded files. The tester wants to use a tool that can be integrated into the application's upload process. Which type of tool is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.