Security Testing Process Overview CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization is adopting a DevSecOps culture and wants to embed security testing into their CI/CD pipeline. They have a limited security team and cannot manually review every automated finding. They need to prioritize which findings to investigate. What is the most effective approach to adapt the ISTQB security testing process to this constraint?

   • AOnly run security tests once a month to reduce the number of findings
   • BReview every finding manually to ensure nothing is missed
   • CDisable automated security testing and rely on manual testing only
   • DAutomate the triage of findings based on severity and exploitability, and escalate only high-risk items for manual review
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team using a DevOps model with continuous integration and continuous deployment wants to integrate security testing into their pipeline. They need to identify vulnerabilities early while not slowing down the release cadence. Which approach best aligns the ISTQB security testing process with their DevOps lifecycle?

   • AConduct security testing only after the software is deployed to production
   • BRun automated security tests in the CI pipeline and perform manual security testing in parallel with development
   • COutsource all security testing to an external vendor before each major release
   • DPerform a full security test cycle only at the end of each release
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After completing a security test, a tester is preparing the final report. They have identified several vulnerabilities with different severity levels. According to the ISTQB security testing process, what is the most important aspect of the report?

   • AFocusing only on the most critical vulnerability
   • BIncluding only the technical details of each vulnerability
   • CProviding a clear summary of findings with risk ratings and recommendations
   • DListing all vulnerabilities without any prioritization
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security tester is documenting the results of a penetration test. They have identified several vulnerabilities, including a critical SQL injection flaw and a low-severity information disclosure issue. According to the ISTQB security testing process, what should the tester include in the final report to help stakeholders prioritize remediation?

   • AOnly the critical vulnerabilities to avoid overwhelming the audience
   • BThe raw test logs without any analysis or summary
   • CA list of all vulnerabilities with their risk ratings and recommended fixes
   • DA pass/fail verdict for the entire application
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does the security testing process typically need to be adapted in an agile development lifecycle compared to a waterfall lifecycle?

   • ASecurity testing is performed by a separate team after each release
   • BSecurity testing is integrated into each iteration, with shorter cycles and continuous feedback
   • CSecurity testing is performed only at the end of the project, just before release
   • DSecurity testing is replaced entirely by automated security scanning tools
   Reveal Solution Discussion Select an answer first