A security tester is asked to test a new API. The goal is to 'ensure the API is secure'. Which of the following is the most specific and measurable security test objective?

Check that the API documentation is complete.

Verify that the API rejects requests with invalid authentication tokens and returns appropriate error codes.

Test the API for common vulnerabilities.

Ensure the API is fast and responsive.

A company is planning a security test of its internal network. The objective is to identify vulnerabilities that could allow an attacker to move laterally. The network includes servers, workstations, and network devices. The company has a limited budget and wants to focus on the most critical assets. Which of the following is the most appropriate scope for this test?

Only the servers that store sensitive data.

Only the network devices, since they control traffic.

All servers, workstations, and network devices, regardless of criticality.

Critical servers, workstations with administrative access, and network devices that segment the network.

An organization is defining its security testing goals. Which of the following is an example of a security testing goal that is aligned with a regulatory requirement?

Complete all security testing activities within the allocated budget

Ensure that the testing team uses the latest version of the security testing tools

Minimize the number of security test cases to reduce execution time

Verify that the application meets the data protection requirements specified by the applicable privacy regulation

A security test team is testing a new cloud storage service. The objective is to identify vulnerabilities that could lead to unauthorized access to stored data. The service uses encryption at rest and in transit. The team has a limited budget and must decide on the coverage of the test. What is the best approach?

Focus coverage on access control mechanisms, encryption key management, and the API used to access the data.

Test the encryption algorithms themselves for weaknesses.

Test the physical security of the data centers.

Test the service's performance under heavy load.

A company is testing a new customer relationship management (CRM) system. The objective is to ensure that customer data is protected from unauthorized access. The CRM integrates with an email marketing service. Which of the following should be included in the scope of the security test?

The CRM system only, since it stores the customer data.

The CRM system and the email marketing service, including the integration between them.

The network infrastructure only, since it connects the systems.

The email marketing service only, since it is the external component.

Certified Tester Security Tester

Domain 2Objective 2

Setting Security Testing Goals and Objectives CT-SEC Practice Questions (Page 2)

Part of the Security Testing Purposes, Goals and Strategies domain, which makes up ~7% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

4concepts

Questions 6–10

6application · medium
A security tester is asked to test a new API. The goal is to 'ensure the API is secure'. Which of the following is the most specific and measurable security test objective?
Select an answer first
7application · medium
A company is planning a security test of its internal network. The objective is to identify vulnerabilities that could allow an attacker to move laterally. The network includes servers, workstations, and network devices. The company has a limited budget and wants to focus on the most critical assets. Which of the following is the most appropriate scope for this test?
Select an answer first
8foundation · easy
An organization is defining its security testing goals. Which of the following is an example of a security testing goal that is aligned with a regulatory requirement?
Select an answer first
9expert · hard
A security test team is testing a new cloud storage service. The objective is to identify vulnerabilities that could lead to unauthorized access to stored data. The service uses encryption at rest and in transit. The team has a limited budget and must decide on the coverage of the test. What is the best approach?
Select an answer first
10application · medium
A company is testing a new customer relationship management (CRM) system. The objective is to ensure that customer data is protected from unauthorized access. The CRM integrates with an email marketing service. Which of the following should be included in the scope of the security test?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Setting Security Testing Goals and Objectives CT-SEC Practice Questions (Page 2)

Questions 6–10

A security tester is asked to test a new API. The goal is to 'ensure the API is secure'. Which of the following is the most specific and measurable security test objective?

An organization is defining its security testing goals. Which of the following is an example of a security testing goal that is aligned with a regulatory requirement?

A company is testing a new customer relationship management (CRM) system. The objective is to ensure that customer data is protected from unauthorized access. The CRM integrates with an email marketing service. Which of the following should be included in the scope of the security test?

Keep studying — Security Testing Purposes, Goals and Strategies