A security tester is conducting a risk identification session for a new mobile banking app. The app will store user credentials and financial data. Which of the following is the most important asset to protect?

The user credentials and financial data.

The development team's laptops.

The company's brand reputation.

A security tester discovers that a web application allows users to upload files without proper validation, which could lead to arbitrary code execution on the server. The organization's risk appetite is low, and the application is business-critical. The team has limited budget and time. Which mitigation strategy best balances risk reduction and resource constraints?

Accept the risk because the likelihood of exploitation is low.

Transfer the risk by purchasing cyber insurance to cover potential losses.

Implement a Web Application Firewall (WAF) rule to block malicious file uploads while developing a permanent fix.

Disable the file upload feature entirely until a permanent fix is developed.

During a risk assessment, a security tester evaluates a risk that has a high likelihood of occurring and a high impact on the business. How should this risk be prioritized?

High priority, because both likelihood and impact are high

Low priority, because the impact is not yet certain

Medium priority, because likelihood and impact balance each other out

Deferred until more data is collected, because the assessment is incomplete

What is the primary goal of risk communication in security testing?

To document all identified risks in a detailed technical report

To assign blame for security issues to specific teams

To convince stakeholders to accept all risks without question

To ensure that stakeholders understand the risks and can make informed decisions

After a risk assessment, a security tester identifies a risk that is considered acceptable by the organization. Which of the following mitigation strategies is most appropriate?

Transfer the risk by purchasing insurance

Mitigate the risk by implementing additional security controls

Avoid the risk by discontinuing the affected feature

Accept the risk, because it is within the organization's risk tolerance

Certified Tester Security Tester

Domain 1Objective 7

Risk Identification, Assessment and Mitigation CT-SEC Practice Questions (Page 3)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

Questions 11–15

11application · medium
A security tester is conducting a risk identification session for a new mobile banking app. The app will store user credentials and financial data. Which of the following is the most important asset to protect?
Select an answer first
12application · medium
A security tester discovers that a web application allows users to upload files without proper validation, which could lead to arbitrary code execution on the server. The organization's risk appetite is low, and the application is business-critical. The team has limited budget and time. Which mitigation strategy best balances risk reduction and resource constraints?
Select an answer first
13foundation · easy
During a risk assessment, a security tester evaluates a risk that has a high likelihood of occurring and a high impact on the business. How should this risk be prioritized?
Select an answer first
14foundation · easy
What is the primary goal of risk communication in security testing?
Select an answer first
15foundation · easy
After a risk assessment, a security tester identifies a risk that is considered acceptable by the organization. Which of the following mitigation strategies is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.