What is the primary goal of a security design review?

To review the code for syntax errors.

To test the system's performance under load.

To identify design flaws and weaknesses before implementation.

To verify that the system meets user interface requirements.

During requirements analysis for a new social media application, the team identifies a requirement that allows users to upload profile pictures. The security tester applies threat modeling to this requirement. Which threat is most relevant to analyze?

Malicious file uploads that could lead to code execution on the server.

SQL injection in the user's profile name field.

Denial of service via excessive API requests.

Cross-site scripting in the comments section.

Certified Tester Security Tester

Domain 4Objective 2

Requirements and Design CT-SEC Practice Questions (Page 8)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

Questions 36–37

36foundation · easy
What is the primary goal of a security design review?
Select an answer first
37application · medium
During requirements analysis for a new social media application, the team identifies a requirement that allows users to upload profile pictures. The security tester applies threat modeling to this requirement. Which threat is most relevant to analyze?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Requirements and Design CT-SEC Practice Questions (Page 8)

Questions 36–37

What is the primary goal of a security design review?

During requirements analysis for a new social media application, the team identifies a requirement that allows users to upload profile pictures. The security tester applies threat modeling to this requirement. Which threat is most relevant to analyze?

Keep studying — Security Testing Throughout the Software Lifecycle