A security tester needs to report the results of a penetration test to a mixed audience: the CISO, the development team, and the IT operations team. The report must be clear and actionable for all stakeholders. What is the most effective approach?

Present only the critical findings to the CISO and keep the technical details for the development team.

Provide a single technical report with detailed exploit steps and code snippets for all stakeholders.

Use a single report with a high-level summary and rely on the stakeholders to ask for more details if needed.

Create an executive summary with risk ratings and business impact, and a separate technical report with detailed findings and remediation steps.

A security assessment finds that multiple user accounts have been compromised. The investigation reveals that all affected users had weak passwords and that the application does not enforce account lockout after multiple failed attempts. The tester also finds that the application logs authentication failures but does not alert on them. What is the most likely root cause of the account compromises?

The use of a shared database for all user accounts.

The absence of multi-factor authentication (MFA).

The lack of a password complexity policy.

The lack of account lockout and failure alerting, which allowed brute-force attacks to succeed undetected.

What is a false positive in security testing?

A vulnerability that is present but has no impact

A reported vulnerability that does not actually exist

A real vulnerability that the test failed to detect

A test that was executed but produced no output

Why is likelihood an important factor in risk-based evaluation?

Because a vulnerability that is unlikely to be exploited may pose a lower risk even if its impact is high

Because it measures how many testers found the vulnerability

Because it is the only factor that matters in risk assessment

Because it determines the exact cost of fixing the vulnerability

What is the primary purpose of security test evaluation within the overall testing process?

To design the security test cases and define the test data

To execute the security tests and collect raw output for the test report

To determine whether identified vulnerabilities pose a real risk and to provide actionable information for remediation

To fix the vulnerabilities that were discovered during testing

Certified Tester Security Tester

Domain 7Objective 1

Security Test Evaluation CT-SEC Practice Questions (Page 6)

Part of the Security Test Evaluation and Reporting domain, which makes up ~6% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 26–30

26application · medium
A security tester needs to report the results of a penetration test to a mixed audience: the CISO, the development team, and the IT operations team. The report must be clear and actionable for all stakeholders. What is the most effective approach?
Select an answer first
27application · medium
A security assessment finds that multiple user accounts have been compromised. The investigation reveals that all affected users had weak passwords and that the application does not enforce account lockout after multiple failed attempts. The tester also finds that the application logs authentication failures but does not alert on them. What is the most likely root cause of the account compromises?
Select an answer first
28foundation · easy
What is a false positive in security testing?
Select an answer first
29foundation · easy
Why is likelihood an important factor in risk-based evaluation?
Select an answer first
30foundation · easy
What is the primary purpose of security test evaluation within the overall testing process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.