A security tester is reviewing the hardening of a web server. The tester wants to verify that the server has been configured to reduce the risk of information disclosure. Which configuration would BEST support this goal?

Enable HTTP compression to reduce bandwidth usage

Configure the server to use HTTP/2 for better performance

Disable directory listing and remove server version headers from HTTP responses

Increase the server's connection timeout to prevent denial-of-service attacks

When assessing hardening gaps, what is the primary factor to consider when prioritizing remediation efforts?

The cost of the remediation tool

The risk posed by the vulnerability and the criticality of the affected system

The ease of implementing the fix

What is the purpose of conducting a hardening gap assessment?

To identify missing or ineffective hardening controls that could leave the system vulnerable

To determine the system's compliance with software licensing agreements

To measure the system's performance under heavy load

To document the system's hardware specifications

What is the primary purpose of system hardening?

To simplify system administration by automating routine tasks

To ensure the system meets all functional requirements of the organization

To increase system performance by removing unnecessary features

To reduce the attack surface by eliminating or mitigating security vulnerabilities

Which of the following methods is commonly used to verify that a system's hardening measures are correctly implemented?

Checking the system's CPU usage

Reviewing the system's uptime statistics

Monitoring user login frequency

Performing a vulnerability scan

Certified Tester Security Tester

Domain 5Objective 1

System Hardening CT-SEC Practice Questions (Page 1)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

Questions 1–5

1application · medium
A security tester is reviewing the hardening of a web server. The tester wants to verify that the server has been configured to reduce the risk of information disclosure. Which configuration would BEST support this goal?
Select an answer first
2foundation · easy
When assessing hardening gaps, what is the primary factor to consider when prioritizing remediation efforts?
Select an answer first
3foundation · easy
What is the purpose of conducting a hardening gap assessment?
Select an answer first
4foundation · easy
What is the primary purpose of system hardening?
Select an answer first
5foundation · easy
Which of the following methods is commonly used to verify that a system's hardening measures are correctly implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.