What is the main purpose of involving security testing in the design phase?

To perform penetration testing on the final product.

To ensure the architecture supports the security requirements.

To define the project schedule.

To write the user manual for the system.

Which of the following is a typical activity during a security design review?

Examining the architecture for potential security weaknesses.

Executing the application to find runtime errors.

Deploying the system to production.

A project manager is planning the requirements phase for a new online banking system. The security tester is invited to participate. Which contribution best demonstrates the role of security testing in requirements?

Review the project budget for security testing activities.

Schedule security testing activities for the testing phase only.

Help identify security requirements such as encryption of sensitive data and multi-factor authentication for high-risk transactions.

Provide a list of penetration testing tools to be used after development.

After a security design review, the team has a set of design artifacts including architecture diagrams and threat models. The security tester is asked to develop a security test plan. Which element should be included in the plan?

A budget for purchasing penetration testing tools.

Test objectives that validate the security controls identified in the design, such as authentication and authorization.

A list of all employees who will have access to the production database.

A schedule for deploying the application to production.

A team is gathering requirements for a new file-sharing application. The security tester applies threat modeling to the requirement 'users can share files with external partners via a link.' Which threat is most important to analyze?

SQL injection in the file name search field.

Cross-site scripting in the file preview page.

Denial of service via excessive file downloads.

Unauthorized access to shared files if the link is guessed or leaked.

Certified Tester Security Tester

Domain 4Objective 2

Requirements and Design CT-SEC Practice Questions (Page 6)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

Questions 26–30

26foundation · easy
What is the main purpose of involving security testing in the design phase?
Select an answer first
27foundation · easy
Which of the following is a typical activity during a security design review?
Select an answer first
28application · medium
A project manager is planning the requirements phase for a new online banking system. The security tester is invited to participate. Which contribution best demonstrates the role of security testing in requirements?
Select an answer first
29application · medium
After a security design review, the team has a set of design artifacts including architecture diagrams and threat models. The security tester is asked to develop a security test plan. Which element should be included in the plan?
Select an answer first
30expert · hard
A team is gathering requirements for a new file-sharing application. The security tester applies threat modeling to the requirement 'users can share files with external partners via a link.' Which threat is most important to analyze?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.