Which of the following is an example of a risk mitigation strategy?

Identifying that a database contains sensitive customer data

Implementing encryption for data at rest to protect customer data

Determining that a vulnerability has a high likelihood of exploitation

Reporting the risk to the project manager for awareness

A company has a risk appetite that is low for any risk that could lead to a data breach. A security tester identifies a vulnerability that could lead to a data breach, but the likelihood of exploitation is very low. What is the most appropriate risk treatment?

Mitigate the risk by implementing a security control, such as patching the vulnerability.

Accept the risk because the likelihood is very low.

Avoid the risk by discontinuing the application.

Transfer the risk by purchasing cyber insurance.

A security tester has completed a risk assessment and needs to report the findings to the project manager. The project manager is not familiar with security terminology. What is the best way to present the risk information?

Present the raw data from the risk assessment tools.

Use a risk register with technical descriptions of each vulnerability.

Only report the risks that have a high risk level.

Provide a summary of risks with their likelihood, impact, and recommended actions in plain language.

A security tester is performing a risk assessment for a new application. The tester has identified a vulnerability in the authentication mechanism. Which of the following is the most appropriate next step?

Document the vulnerability in the risk register.

Report the vulnerability to the development team.

Determine the likelihood and impact of the vulnerability being exploited.

Immediately fix the vulnerability.

Certified Tester Security Tester

Domain 1Objective 7

Risk Identification, Assessment and Mitigation CT-SEC Practice Questions (Page 5)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

Questions 21–24

21foundation · easy
Which of the following is an example of a risk mitigation strategy?
Select an answer first
22application · medium
A company has a risk appetite that is low for any risk that could lead to a data breach. A security tester identifies a vulnerability that could lead to a data breach, but the likelihood of exploitation is very low. What is the most appropriate risk treatment?
Select an answer first
23application · medium
A security tester has completed a risk assessment and needs to report the findings to the project manager. The project manager is not familiar with security terminology. What is the best way to present the risk information?
Select an answer first
24application · medium
A security tester is performing a risk assessment for a new application. The tester has identified a vulnerability in the authentication mechanism. Which of the following is the most appropriate next step?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.