Security Testing Process Overview CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is using a hybrid development model where some teams follow agile and others follow waterfall. The security team needs to standardize their testing process across all teams. What is the most effective way to adapt the ISTQB security testing process to this mixed environment?

   • ACreate completely separate security testing processes for each team
   • BUse the same security testing process for all teams, regardless of lifecycle
   • CDefine a core security testing process with flexible activities that can be tailored to each lifecycle
   • DRequire all teams to adopt a waterfall approach for security testing
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization is transitioning from a waterfall to an agile development model. The security team currently produces a comprehensive security test report at the end of each release. In the new agile model, stakeholders expect faster feedback and iterative delivery. How should the security testing process be adapted to meet these expectations while maintaining thoroughness?

   • AContinue with the end-of-release report but add a brief summary of security issues in each sprint review
   • BPerform security testing in each sprint and provide incremental reports, with a consolidated report at release
   • CReduce the scope of security testing to only critical features to save time
   • DMove all security testing to a dedicated team that works independently of the agile teams
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is planning a security test for a new application. They have identified the security objectives, scope, and risks. According to the ISTQB security testing process, what should they include in the test plan?

   • AThe final results of the security tests
   • BThe security test objectives, scope, resources, and schedule
   • CA list of vulnerabilities found in previous tests
   • DA detailed list of all test cases with expected results
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is adopting the ISTQB security testing process for a new web application. During the planning phase, they identify the scope, security objectives, and applicable regulations. They also decide on the test design techniques to use. Which activity should they perform NEXT in the ISTQB security testing process?

   • AExecute the security tests and record the results
   • BCreate security test cases based on the identified techniques
   • CWrite the final security test report for stakeholders
   • DDefine the entry and exit criteria for security testing
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security tester is planning a security test for a web application. They have identified the assets to protect, the potential threats, and the security objectives. According to the ISTQB security testing process, what should they do during the design phase?

   • ADefine the test environment and required tools
   • BExecute the test cases and record defects
   • CDevelop security test cases and test data
   • DEvaluate the results and write the final report
   Reveal Solution Discussion Select an answer first