A company is subject to multiple regulations and wants to streamline its compliance efforts by adopting a single standard that can help address several regulatory requirements. The company also wants to avoid duplication of effort. Which approach is most effective?

Adopt ISO/IEC 27001 as a common framework and map other regulations to it

Use OWASP Top 10 as the primary standard for all compliance

Rely solely on NIST CSF for all regulatory compliance

Implement separate compliance programs for each regulation

When selecting a security standard for an organization, which factor is most important to consider first?

The organization's specific industry, regulatory requirements, and security objectives.

The cost of the standard's documentation.

The popularity of the standard among security professionals.

The number of controls defined in the standard.

A financial institution is required by its regulator to implement a risk-based security program and must select a framework that provides a common language for cybersecurity risk management across the organization. Which standard is most appropriate?

NIST Cybersecurity Framework (CSF)

How do security standards primarily influence the way security testing is conducted?

By automatically generating security test reports without human input.

By providing a structured methodology and criteria for evaluating security posture.

By legally requiring all organizations to perform security testing annually.

By defining specific test cases that must be executed in every security test.

Certified Tester Security Tester

Domain 9Objective 3

Selection of Security Standards CT-SEC Practice Questions (Page 2)

Part of the Standards and Industry Trends domain, which makes up ~11% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

Questions 6–10

6expert · hard
A company is subject to multiple regulations and wants to streamline its compliance efforts by adopting a single standard that can help address several regulatory requirements. The company also wants to avoid duplication of effort. Which approach is most effective?
Select an answer first
7foundation · easy
When selecting a security standard for an organization, which factor is most important to consider first?
Select an answer first
8application · medium
A financial institution is required by its regulator to implement a risk-based security program and must select a framework that provides a common language for cybersecurity risk management across the organization. Which standard is most appropriate?
Select an answer first
9application · medium
A government contractor must comply with federal information security requirements and needs a standard that provides a comprehensive set of security controls for information systems. Which standard should the contractor use?
Select an answer first
10foundation · easy
How do security standards primarily influence the way security testing is conducted?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.