Security Testing Process Overview CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the ISTQB security testing process, which activity is performed during the security test design phase?

   • ACreating security test cases and test procedures based on the identified threats and risks
   • BExecuting the security test cases and recording the results
   • CIdentifying the security test objectives and the scope of testing
   • DSummarizing the security test results and providing a final assessment
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security tester is preparing to execute a security test. They have a detailed test plan, test cases, and the test environment is ready. According to the ISTQB security testing process, what is the primary activity during the execution phase?

   • ARunning the test cases and recording the actual results
   • BDesigning additional test cases for uncovered areas
   • CUpdating the test plan based on initial findings
   • DWriting the final test report
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security tester is conducting a security test for a financial application. During the execution phase, they find a vulnerability that could allow unauthorized access to customer accounts. The tester also notices that the vulnerability is in a module that is scheduled for a major refactor in the next release. How should the tester handle this finding in the report?

   • AReport the vulnerability as low priority because the module will be refactored
   • BOmit the vulnerability from the report because the module will be refactored
   • CFix the vulnerability directly and do not report it
   • DReport the vulnerability with a high priority, noting the planned refactor and recommending a temporary mitigation
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team using an agile development model wants to incorporate security testing into their sprints. They have a two-week sprint cycle and need to ensure security issues are identified and addressed within the same sprint. How should they adapt the ISTQB security testing process?

   • AInclude security testing tasks in each sprint, with a focus on the features developed in that sprint
   • BSkip security testing until the final release
   • CCreate a separate security testing phase after each sprint
   • DPerform all security testing at the end of the project
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is developing a safety-critical system using a traditional waterfall lifecycle. The security testing team must ensure that security requirements are verified at each stage. How should they adapt the ISTQB security testing process to this lifecycle model?

   • AUse only automated security testing tools without any manual review
   • BIntegrate security testing activities into each phase, from requirements to maintenance
   • CSkip security testing because the system is safety-critical and already well-specified
   • DConduct all security testing in a single phase after implementation is complete
   Reveal Solution Discussion Select an answer first