Security Testing Process Overview CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security tester is in the design phase of a security test. They have identified the security objectives and risks during planning. What should they do to create effective security test cases?

   • ADevelop test cases based on the identified risks and security objectives
   • BCreate test cases only for the most critical risks and ignore others
   • CUse only standard test cases from a template without considering the application's specific risks
   • DWait until the execution phase to decide on test cases
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security tester is conducting a security test for a critical application. During the planning phase, they identify that the application handles personally identifiable information (PII) and is subject to GDPR. They also note that the application is developed using a DevOps model with frequent releases. How should the tester incorporate GDPR requirements into the security testing process?

   • AInclude GDPR-specific test cases in the design phase and ensure they are executed in each release cycle
   • BOutsource GDPR compliance testing to a legal team
   • CFocus only on technical vulnerabilities and ignore GDPR requirements
   • DPerform a one-time GDPR compliance check before the initial release
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which activity is part of the security test execution phase in the ISTQB security testing process?

   • ADefining the security test environment and required tools
   • BDetermining the security test exit criteria
   • CWriting the final security test report for stakeholders
   • DRunning the security test cases and logging the actual results
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A DevOps team wants to integrate security testing into their CI/CD pipeline. They have a mix of automated SAST and DAST tools, but they are concerned about the high number of false positives. They also need to ensure that critical vulnerabilities are not missed. How should they adapt the ISTQB security testing process to address this challenge?

   • ARun the tools only once a month to avoid overwhelming the team
   • BTune the tools to reduce false positives and add a manual review step for triage
   • CIgnore false positives and focus only on the critical findings
   • DDisable the SAST tool to reduce noise and rely only on DAST
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During the execution phase of a security test, a tester discovers a critical vulnerability that could allow an attacker to access sensitive customer data. According to the ISTQB security testing process, what should the tester do FIRST?

   • ADocument the vulnerability and report it immediately to the relevant stakeholders
   • BContinue testing to find more vulnerabilities before reporting
   • CWait until the end of the test to include it in the final report
   • DFix the vulnerability directly in the code
   Reveal Solution Discussion Select an answer first