A company's security team is about to conduct a vulnerability scan of its internal network. The team has a limited maintenance window and needs to ensure that the scan does not disrupt business operations. Which process step should be prioritized to meet this requirement?

Immediately run the scan to identify vulnerabilities as quickly as possible.

Schedule the scan for a time when the network is least busy, without informing system owners.

Select the most advanced scanning tool available on the market.

Define the scope and obtain proper authorization from system owners.

A security tester is documenting the results of a vulnerability scan. The tester has identified several vulnerabilities with different severity levels. Which process step is most important to ensure that the most critical vulnerabilities are addressed first?

Assign all vulnerabilities to a single developer for remediation.

List the vulnerabilities in the order they were discovered.

Prioritize the vulnerabilities based on risk and potential impact.

Immediately fix all vulnerabilities without prioritization.

A security testing team is facing a high turnover rate. Experienced testers are leaving, and new hires are not yet productive. The team lead wants to maintain the quality of security testing while the team is in transition. Which approach best addresses the situation?

Hire temporary consultants to fill the gaps.

Document the testing processes and create a knowledge base for new testers.

Rely on automated tools to compensate for the lack of experienced testers.

Reduce the scope of testing until the team is fully staffed.

What is the primary purpose of a web application security scanner?

To manage user access permissions within a web application

To automatically identify common web vulnerabilities such as SQL injection and cross-site scripting

To encrypt data transmitted between a web server and a client

To monitor network traffic for intrusion attempts in real time

Certified Tester Security Tester

Domain 1Objective 8

People, Process and Technology CT-SEC Practice Questions (Page 3)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

4concepts

Questions 11–15

11application · medium
A company's security team is about to conduct a vulnerability scan of its internal network. The team has a limited maintenance window and needs to ensure that the scan does not disrupt business operations. Which process step should be prioritized to meet this requirement?
Select an answer first
12application · medium
A security tester is documenting the results of a vulnerability scan. The tester has identified several vulnerabilities with different severity levels. Which process step is most important to ensure that the most critical vulnerabilities are addressed first?
Select an answer first
13expert · hard
A security testing team is facing a high turnover rate. Experienced testers are leaving, and new hires are not yet productive. The team lead wants to maintain the quality of security testing while the team is in transition. Which approach best addresses the situation?
Select an answer first
14foundation · easy
Which type of tool is specifically designed to automate the process of sending malformed or unexpected input to an application to discover vulnerabilities?
Select an answer first
15foundation · easy
What is the primary purpose of a web application security scanner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.