A company is planning a security test for its new online payment system. The business objective is to ensure customer data is protected and to meet PCI DSS compliance. What should be the primary focus of the security test plan?

Aligning the test scope and objectives with the business goal of protecting customer data and meeting compliance

Selecting the most expensive testing tools to ensure thorough coverage

Focusing only on the payment gateway and ignoring other components

Hiring the largest number of testers to complete the test quickly

A security tester has been hired to conduct a penetration test for a client. The client has provided a signed authorization letter, but the tester's own company policy requires a formal contract and a detailed test plan to be approved by the company's legal department. The client wants the test to start immediately. What should the tester do?

Delay the test until the contract and test plan are approved by the tester's legal department.

Start the test immediately because the client's authorization is sufficient.

Ask the client to sign a waiver that exempts the tester from company policy.

Conduct a limited test without a contract to satisfy the client's urgency.

A security team is planning a test for a web application that is hosted in a hybrid cloud environment. The test must cover both on-premises and cloud components. The team has limited experience with cloud security testing. The budget is sufficient to hire an external consultant or to train internal staff. What is the most effective way to ensure the test is thorough and effective?

Use automated tools only, without any manual testing.

Hire an external consultant with cloud security expertise to lead the test.

Train internal staff on cloud security testing and conduct the test in-house.

Limit the test to on-premises components to avoid cloud complexity.

A security tester is asked to perform a vulnerability assessment on a partner's external network. The partner has provided a written authorization but the tester's own organization has a policy that requires all external testing to be approved by the internal security committee. What should the tester do?

Conduct the test but limit it to passive techniques to avoid detection.

Ask the partner to sign a waiver releasing the tester from internal policy.

Proceed with the test because the partner's authorization is sufficient.

Obtain approval from the internal security committee before starting the test.

In a security test plan, what does the 'risk assessment' component primarily address?

The likelihood and impact of potential security issues in the system

The number of test cases to be executed

The total cost of the testing tools and licenses

The technical skills of the testers

Certified Tester Security Tester

Domain 3Objective 2

Security Test Planning CT-SEC Practice Questions (Page 2)

Part of the Security Testing Processes domain, which makes up ~9% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 1–1 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 6–10

6application · medium
A company is planning a security test for its new online payment system. The business objective is to ensure customer data is protected and to meet PCI DSS compliance. What should be the primary focus of the security test plan?
Select an answer first
7expert · hard
A security tester has been hired to conduct a penetration test for a client. The client has provided a signed authorization letter, but the tester's own company policy requires a formal contract and a detailed test plan to be approved by the company's legal department. The client wants the test to start immediately. What should the tester do?
Select an answer first
8expert · hard
A security team is planning a test for a web application that is hosted in a hybrid cloud environment. The test must cover both on-premises and cloud components. The team has limited experience with cloud security testing. The budget is sufficient to hire an external consultant or to train internal staff. What is the most effective way to ensure the test is thorough and effective?
Select an answer first
9application · medium
A security tester is asked to perform a vulnerability assessment on a partner's external network. The partner has provided a written authorization but the tester's own organization has a policy that requires all external testing to be approved by the internal security committee. What should the tester do?
Select an answer first
10foundation · easy
In a security test plan, what does the 'risk assessment' component primarily address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Security Test Planning CT-SEC Practice Questions (Page 2)

Questions 6–10

A company is planning a security test for its new online payment system. The business objective is to ensure customer data is protected and to meet PCI DSS compliance. What should be the primary focus of the security test plan?

In a security test plan, what does the 'risk assessment' component primarily address?

Keep studying — Security Testing Processes