A security tester has identified a medium-risk vulnerability in an internal application. The vulnerability could allow an attacker to access sensitive employee data. The tester needs to communicate this to the IT manager. What is the most appropriate way to report this risk?

Report the risk to the legal department instead of the IT manager.

Include the risk in the next monthly security report without highlighting it.

Schedule a meeting with the IT manager to discuss the risk, its potential impact, and recommended mitigation steps.

Send an email to the IT manager with a detailed technical analysis of the vulnerability.

During a security risk identification activity, a tester is analyzing a web application that stores customer data. Which of the following is the primary purpose of this activity?

To determine the likelihood and impact of each potential security incident

To communicate the identified risks to stakeholders to support decision-making

To select and implement controls to reduce the identified risks to an acceptable level

To identify potential security risks by analyzing assets, threats, and vulnerabilities

A company is developing a mobile app that stores user health data. During a risk identification workshop, the team brainstorms potential threats. Which of the following is an example of a threat, as opposed to a vulnerability or asset?

The app does not encrypt health data at rest.

The user health data stored in the app's database.

The risk of a data breach is high.

A hacker could exploit a weak API to access user health data.

After a security assessment, a tester identifies a critical vulnerability in a customer-facing application. The vulnerability has a high likelihood of exploitation and high impact. The tester needs to communicate this risk to the business stakeholders, who are not technical. What is the most effective way to communicate this risk?

Present the technical details of the vulnerability, including the exact exploit code and affected code lines.

Explain the risk in terms of potential business impact, such as financial loss, reputational damage, and regulatory fines.

Send a brief email stating that the application has a critical vulnerability and that it must be fixed immediately.

Wait until the vulnerability is fixed before informing stakeholders to avoid causing unnecessary concern.

Certified Tester Security Tester

Domain 1Objective 7

Risk Identification, Assessment and Mitigation CT-SEC Practice Questions (Page 1)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

Questions 1–5

1application · medium
A security tester has identified a medium-risk vulnerability in an internal application. The vulnerability could allow an attacker to access sensitive employee data. The tester needs to communicate this to the IT manager. What is the most appropriate way to report this risk?
Select an answer first
2foundation · easy
During a security risk identification activity, a tester is analyzing a web application that stores customer data. Which of the following is the primary purpose of this activity?
Select an answer first
3application · medium
A security tester is assessing risks for a new e-commerce platform. The tester identifies a vulnerability that could allow an attacker to access customer payment information. The likelihood of exploitation is medium, and the impact is high. According to a standard risk matrix, what is the overall risk level?
Select an answer first
4application · medium
A company is developing a mobile app that stores user health data. During a risk identification workshop, the team brainstorms potential threats. Which of the following is an example of a threat, as opposed to a vulnerability or asset?
Select an answer first
5application · medium
After a security assessment, a tester identifies a critical vulnerability in a customer-facing application. The vulnerability has a high likelihood of exploitation and high impact. The tester needs to communicate this risk to the business stakeholders, who are not technical. What is the most effective way to communicate this risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Risk Identification, Assessment and Mitigation CT-SEC Practice Questions (Page 1)

Questions 1–5

A security tester has identified a medium-risk vulnerability in an internal application. The vulnerability could allow an attacker to access sensitive employee data. The tester needs to communicate this to the IT manager. What is the most appropriate way to report this risk?

During a security risk identification activity, a tester is analyzing a web application that stores customer data. Which of the following is the primary purpose of this activity?

A company is developing a mobile app that stores user health data. During a risk identification workshop, the team brainstorms potential threats. Which of the following is an example of a threat, as opposed to a vulnerability or asset?

Keep studying — The Basis of Security Testing