What is the main goal of analyzing security test results?

To verify that all test tools were used correctly

To assign blame for the security weaknesses

To determine the presence and severity of vulnerabilities

To count the total number of test cases executed

Which activity is part of the scope of security test evaluation?

Installing the application in the production environment

Determining whether a reported vulnerability is a true positive or a false positive

Writing the security test policy for the organization

Selecting the security testing tools to be used in the project

What is the main goal of reporting evaluation outcomes to stakeholders?

To impress stakeholders with the technical details of the testing

To list every raw test output without interpretation

To provide clear and actionable information that supports decision-making

To assign blame for the security issues

When analyzing a security test result, what does the 'severity' of a vulnerability primarily indicate?

The time required to fix the vulnerability

The likelihood that the vulnerability will be discovered by an attacker

The potential impact of the vulnerability if it is exploited

The number of times the vulnerability was detected during testing

A penetration test identifies three findings: (1) a critical SQL injection in a public-facing login form, (2) a medium-severity information disclosure in an internal API, and (3) a low-severity missing security header on a static content server. The company has limited resources and can only fix one finding this quarter. Which finding should be prioritized?

The information disclosure in the internal API, because it affects an internal system.

All three findings should be fixed simultaneously, regardless of resources.

The SQL injection in the public-facing login form, because it has the highest risk and business impact.

The missing security header, because it is the easiest and quickest to fix.

Certified Tester Security Tester

Domain 7Objective 1

Security Test Evaluation CT-SEC Practice Questions (Page 3)

Part of the Security Test Evaluation and Reporting domain, which makes up ~6% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 11–15

11foundation · easy
What is the main goal of analyzing security test results?
Select an answer first
12foundation · easy
Which activity is part of the scope of security test evaluation?
Select an answer first
13foundation · easy
What is the main goal of reporting evaluation outcomes to stakeholders?
Select an answer first
14foundation · easy
When analyzing a security test result, what does the 'severity' of a vulnerability primarily indicate?
Select an answer first
15application · medium
A penetration test identifies three findings: (1) a critical SQL injection in a public-facing login form, (2) a medium-severity information disclosure in an internal API, and (3) a low-severity missing security header on a static content server. The company has limited resources and can only fix one finding this quarter. Which finding should be prioritized?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.