A security tester is evaluating a server that hosts a critical application. The server was hardened six months ago, but since then, several new services have been installed by the application team. The tester must determine whether the server is still compliant with the hardening baseline. Which approach is MOST appropriate?

Run a compliance scan against the current baseline and compare the results to the baseline to identify any new services or configuration changes

Assume the server is still compliant because it was hardened six months ago

Review the change management logs to see what services were installed and assume the server is compliant if the changes were approved

Interview the application team to understand why the new services were installed and accept their justification

A security tester is verifying the effectiveness of a hardening baseline on a fleet of 200 identical Linux workstations. The tester previously ran a compliance scan and found that 95% of the systems passed. The tester now needs to determine whether the 5% that failed are due to configuration drift or due to an error in the baseline itself. Which approach would BEST distinguish between these two causes?

Compare the failing systems' configurations against a known-good system that passed the scan, and review the specific failed checks for false positives

Immediately reimage the failing systems with the standard image and re-scan them

Re-run the compliance scan on all 200 systems to confirm the results are consistent

Review the change management logs for the failing systems to see when they were last updated

A security tester is explaining to a colleague why system hardening is important even for systems that are not directly exposed to the internet. Which reason BEST justifies hardening internal systems?

Internal systems can be used as a pivot point for attackers who have already breached the network perimeter

Internal systems are not at risk because they are behind the firewall

Hardening is only required for systems that process sensitive data

Hardening internal systems is a regulatory requirement in all industries

A security tester is assessing a server that runs a critical application. The server has a known vulnerability in the application software, but the vendor has not yet released a patch. The tester discovers that the application is running with administrative privileges, which increases the impact of a potential exploit. The tester must recommend a mitigation. Which recommendation is MOST appropriate?

Run the application with the least privileges required, and apply additional monitoring and logging around the application

Apply a virtual patch using a web application firewall to block exploit attempts

Immediately uninstall the application until the vendor releases a patch

Wait for the vendor to release a patch and do nothing in the meantime

A security tester is reviewing the hardening of a new application server. The server was configured using a security baseline, but the tester notices that the baseline does not include a setting to disable USB storage devices. The organization's policy requires that USB storage be disabled on all servers. What should the tester do?

Accept the baseline as-is because it is a published standard and should not be modified

Report that the server is fully hardened because it follows the published baseline

Manually disable USB storage on this server but do not update the baseline

Flag the missing control as a hardening gap and recommend updating the baseline to include the USB storage restriction

Certified Tester Security Tester

Domain 5Objective 1

System Hardening CT-SEC Practice Questions (Page 3)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

Questions 11–15

11expert · hard
A security tester is evaluating a server that hosts a critical application. The server was hardened six months ago, but since then, several new services have been installed by the application team. The tester must determine whether the server is still compliant with the hardening baseline. Which approach is MOST appropriate?
Select an answer first
12expert · hard
A security tester is verifying the effectiveness of a hardening baseline on a fleet of 200 identical Linux workstations. The tester previously ran a compliance scan and found that 95% of the systems passed. The tester now needs to determine whether the 5% that failed are due to configuration drift or due to an error in the baseline itself. Which approach would BEST distinguish between these two causes?
Select an answer first
13application · medium
A security tester is explaining to a colleague why system hardening is important even for systems that are not directly exposed to the internet. Which reason BEST justifies hardening internal systems?
Select an answer first
14expert · hard
A security tester is assessing a server that runs a critical application. The server has a known vulnerability in the application software, but the vendor has not yet released a patch. The tester discovers that the application is running with administrative privileges, which increases the impact of a potential exploit. The tester must recommend a mitigation. Which recommendation is MOST appropriate?
Select an answer first
15application · medium
A security tester is reviewing the hardening of a new application server. The server was configured using a security baseline, but the tester notices that the baseline does not include a setting to disable USB storage devices. The organization's policy requires that USB storage be disabled on all servers. What should the tester do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

System Hardening CT-SEC Practice Questions (Page 3)

Questions 11–15

A security tester is explaining to a colleague why system hardening is important even for systems that are not directly exposed to the internet. Which reason BEST justifies hardening internal systems?

Keep studying — Testing Security Mechanisms