During requirements elicitation for a corporate document management system, the team identifies several security requirements: encryption of documents at rest, two-factor authentication for remote access, and a public sharing link feature. The security tester must prioritize these for implementation. Which approach best reflects security risk assessment in requirements?

Prioritize based on the ease of implementation, implementing the simplest requirements first.

Let the product owner decide the priority based on customer demand.

Implement all requirements simultaneously to avoid any delay in security coverage.

Rank requirements by the likelihood and impact of a security breach if the requirement is not met.

A design for a new online learning platform includes a content delivery network (CDN), a web application, and a database. The security tester is asked to validate the design. Which action best validates that the architecture supports security requirements?

Ensure that the web application uses the latest version of the programming language.

Ensure that the CDN is configured to enforce HTTPS and that the web application uses secure session management.

Confirm that the database is hosted on a separate server from the web application.

Verify that the CDN is used to cache all static content for performance.

How does security testing inform design decisions?

By writing the design document for the developers.

By ensuring the design is aesthetically pleasing.

By selecting the hardware for the production environment.

By providing feedback on the effectiveness of security controls in the architecture.

Which artifact is most commonly used as input for design-level threat modeling?

The compiled executable of the application.

Architecture diagrams and design documents.

How does security testing influence the requirements phase?

By performing penetration testing on the requirements document.

By defining the security test cases that will be executed during system testing.

By selecting the security testing tools to be used in the project.

By helping to elicit and refine security requirements based on identified threats.

Certified Tester Security Tester

Domain 4Objective 2

Requirements and Design CT-SEC Practice Questions (Page 5)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

Questions 21–25

21application · medium
During requirements elicitation for a corporate document management system, the team identifies several security requirements: encryption of documents at rest, two-factor authentication for remote access, and a public sharing link feature. The security tester must prioritize these for implementation. Which approach best reflects security risk assessment in requirements?
Select an answer first
22expert · hard
A design for a new online learning platform includes a content delivery network (CDN), a web application, and a database. The security tester is asked to validate the design. Which action best validates that the architecture supports security requirements?
Select an answer first
23foundation · easy
How does security testing inform design decisions?
Select an answer first
24foundation · easy
Which artifact is most commonly used as input for design-level threat modeling?
Select an answer first
25foundation · easy
How does security testing influence the requirements phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.