A startup is developing a new IoT device. The security team wants to conduct a security test. The CEO is concerned about time-to-market and wants the test to be quick. The legal team requires compliance with the new IoT security regulations. What should the security team do to align the test goals with these expectations?

Perform a full security test without considering the time constraint.

Define a minimal set of test objectives that cover the regulatory requirements and communicate the trade-off between speed and coverage.

Skip the security test to meet the time-to-market deadline.

Ask the legal team to relax the regulatory requirements.

A security test team is testing a new online payment system. The objective is to identify vulnerabilities that could lead to financial fraud. The team has a limited budget. Which of the following best defines the coverage of this test?

Test the system's ability to handle high transaction volumes.

Test all payment processing functions, including transaction validation, authentication, and authorization.

Test only the transaction validation logic.

Test only the user interface for any security issues.

What does 'coverage' in security testing refer to?

The depth and breadth of testing required to achieve the security test objectives

The number of security testers assigned to the project

The total budget allocated for security testing

The list of security testing tools to be used

A security analyst is asked to test a new file upload feature. The overall goal is to 'prevent malicious file uploads'. Which of the following is the most appropriate security test objective?

Verify that the system rejects files with dangerous extensions (e.g., .exe, .php) and files that are too large.

Check that the file upload feature works with all browsers.

Ensure that the file upload feature is user-friendly.

Test the file upload feature for any security issues.

A security test team is planning a test for a new mobile banking app. The objective is to ensure that sensitive financial data is protected during transmission and storage. Which of the following best defines the coverage of this security test?

Test both data in transit and data at rest, including encryption mechanisms and storage security.

Test the app's user interface for any security-related issues.

Test the backend servers only, since they store the data.

Test only the encryption of data in transit, as that is the most critical aspect.

Certified Tester Security Tester

Domain 2Objective 2

Setting Security Testing Goals and Objectives CT-SEC Practice Questions (Page 3)

Part of the Security Testing Purposes, Goals and Strategies domain, which makes up ~7% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

4concepts

Questions 11–15

11application · medium
A startup is developing a new IoT device. The security team wants to conduct a security test. The CEO is concerned about time-to-market and wants the test to be quick. The legal team requires compliance with the new IoT security regulations. What should the security team do to align the test goals with these expectations?
Select an answer first
12application · medium
A security test team is testing a new online payment system. The objective is to identify vulnerabilities that could lead to financial fraud. The team has a limited budget. Which of the following best defines the coverage of this test?
Select an answer first
13foundation · easy
What does 'coverage' in security testing refer to?
Select an answer first
14application · medium
A security analyst is asked to test a new file upload feature. The overall goal is to 'prevent malicious file uploads'. Which of the following is the most appropriate security test objective?
Select an answer first
15application · medium
A security test team is planning a test for a new mobile banking app. The objective is to ensure that sensitive financial data is protected during transmission and storage. Which of the following best defines the coverage of this security test?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.