During system testing, what is the primary purpose of security testing?

To ensure that all security defects found during unit testing have been fixed before release

To validate that the system's security features are user-friendly and intuitive

To confirm that the system is free from all possible security vulnerabilities

To verify that the system meets its specified security requirements and does not contain exploitable vulnerabilities

During operational acceptance testing (OAT), what does security testing primarily validate?

That the system's security features are acceptable to end users

That the system's security architecture is documented

That the system is free from all known vulnerabilities

That the security controls operate correctly in the production-like environment and that the operations team can manage them effectively

A company is in the operational acceptance testing phase for a new system. The system must be able to detect and respond to security incidents. The operational team has limited resources. What should the security testers prioritize?

Verifying that the system's security monitoring and alerting mechanisms are effective and that incident response procedures are documented.

Performing a full penetration test of the system.

Testing the system's user interface for ease of use.

Ensuring that all users have strong passwords.

In acceptance testing, what is the main focus of security testing during user acceptance testing (UAT)?

To verify that security controls meet the expectations and requirements of the stakeholders and users

To ensure that all security defects are fixed before the system is deployed

To perform a full penetration test of the system in the production environment

To verify that the system's security features are documented for the operations team

A company is developing a new application that will be used by external customers. The security team has limited time and resources. They need to prioritize security testing activities during system testing. Which approach is most effective?

Perform a penetration test after deployment to identify vulnerabilities.

Test all security requirements equally to ensure complete coverage.

Skip security testing and rely on the vendor's assurance that the application is secure.

Focus on testing the most critical security requirements and high-risk areas, such as authentication and data protection.

Certified Tester Security Tester

Domain 4Objective 4

System, Acceptance, and Maintenance CT-SEC Practice Questions (Page 4)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

3concepts

Questions 16–20

16foundation · easy
During system testing, what is the primary purpose of security testing?
Select an answer first
17foundation · easy
During operational acceptance testing (OAT), what does security testing primarily validate?
Select an answer first
18expert · hard
A company is in the operational acceptance testing phase for a new system. The system must be able to detect and respond to security incidents. The operational team has limited resources. What should the security testers prioritize?
Select an answer first
19foundation · easy
In acceptance testing, what is the main focus of security testing during user acceptance testing (UAT)?
Select an answer first
20expert · hard
A company is developing a new application that will be used by external customers. The security team has limited time and resources. They need to prioritize security testing activities during system testing. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.