A security tester is developing a test plan for a new mobile banking app. The plan must clearly define what systems will be tested, what testing techniques will be used, and the boundaries of the assessment. Which element of the test plan is most critical to document first?

The list of testing tools and their licensing costs

The scope, including in-scope and out-of-scope systems and functionalities

The names of the testers and their certifications

The date of the next board meeting

Why is thorough planning critical for effective security testing?

It ensures that testing is performed without any errors

It eliminates the need for manual testing

It guarantees that all security defects are found

It optimizes resource use and helps mitigate risks

What is the primary role of obtaining approvals in security testing?

To document the test results for future reference

To ensure that testing activities are authorized and comply with policies

To speed up the testing process by skipping certain steps

To assign specific test cases to individual testers

A company wants to assess the security of its new cloud-based customer relationship management (CRM) system. The security team is creating a test plan. Which of the following should be the primary objective of this test plan?

List all security vulnerabilities found in the previous year's test.

Identify security risks and define the scope of testing to align with business goals.

Document the names of all employees who will use the CRM system.

Guarantee that the CRM system is 100% secure after testing.

Which of the following is a primary goal of security test planning?

To automate all security testing activities without manual intervention

To guarantee that all vulnerabilities are eliminated before release

To identify risks, define scope, and align testing with business objectives

To document all possible attack vectors for the system

Certified Tester Security Tester

Domain 3Objective 2

Security Test Planning CT-SEC Practice Questions (Page 1)

Part of the Security Testing Processes domain, which makes up ~9% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 1–1 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 1–5

1application · medium
A security tester is developing a test plan for a new mobile banking app. The plan must clearly define what systems will be tested, what testing techniques will be used, and the boundaries of the assessment. Which element of the test plan is most critical to document first?
Select an answer first
2foundation · easy
Why is thorough planning critical for effective security testing?
Select an answer first
3foundation · easy
What is the primary role of obtaining approvals in security testing?
Select an answer first
4application · medium
A company wants to assess the security of its new cloud-based customer relationship management (CRM) system. The security team is creating a test plan. Which of the following should be the primary objective of this test plan?
Select an answer first
5foundation · easy
Which of the following is a primary goal of security test planning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.