During requirements elicitation, which activity is most directly associated with specifying authorization requirements?

Defining how data is protected from unauthorized disclosure.

Determining how users prove their identity to the system.

Specifying the maximum acceptable downtime for the system.

Defining which users can perform which actions on which resources.

Which of the following is an example of a security requirement related to confidentiality?

The system must verify the identity of users before granting access.

The system must encrypt all sensitive data at rest and in transit.

The system must be available 99.9% of the time.

The system must ensure that data is not modified by unauthorized users.

What is the primary purpose of a security test plan developed during the design phase?

To outline the objectives, scope, and techniques for validating security controls.

To provide a detailed design of the system architecture.

To list all known vulnerabilities in the system.

To document the security requirements for the project.

A design for a new e-commerce platform includes a payment service, an inventory service, and a user service communicating over a message bus. The security tester is asked to apply threat modeling at the design level. Which approach is most appropriate?

Review the source code of each service for security bugs.

Ask the architect to simplify the architecture to reduce the number of services.

Run a vulnerability scanner against the deployed services to find known CVEs.

Create a data flow diagram and identify threats like spoofing of services or tampering with messages on the bus.

Certified Tester Security Tester

Domain 4Objective 2

Requirements and Design CT-SEC Practice Questions (Page 4)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

Questions 16–20

16foundation · easy
During requirements elicitation, which activity is most directly associated with specifying authorization requirements?
Select an answer first
17foundation · easy
Which of the following is an example of a security requirement related to confidentiality?
Select an answer first
18foundation · easy
In security risk assessment, what two factors are typically used to determine the level of risk?
Select an answer first
19foundation · easy
What is the primary purpose of a security test plan developed during the design phase?
Select an answer first
20application · medium
A design for a new e-commerce platform includes a payment service, an inventory service, and a user service communicating over a message bus. The security tester is asked to apply threat modeling at the design level. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.