A company wants to reduce the risk of credential theft and insider misuse. The security team is considering implementing a password manager and single sign-on (SSO). Which outcome is the primary security benefit of this approach?

Ensures passwords are never compromised

Eliminates the need for multi-factor authentication

Reduces password reuse and enables centralized access control

A company is concerned about insider threats. The security team wants to implement controls to detect and prevent both malicious and negligent insider actions. Which combination of controls would be most effective?

Regular security audits and penetration testing

Background checks and security awareness training

User activity monitoring, data loss prevention, and role-based access control

Strict password policies and multi-factor authentication

Which combination of measures is most effective in reducing the risk of employees falling for phishing emails?

Security awareness training and email filtering

Disabling all email attachments

Only implementing a strong password policy

A company has a high rate of employees falling for phishing emails. The security team is considering a new training program. Which approach is most likely to reduce the click rate over time?

Run simulated phishing campaigns monthly and provide immediate feedback to those who click

Send a weekly email newsletter with security tips

Conduct a one-time, mandatory training session for all employees

Implement a technical control that blocks all external emails

Certified Tester Security Tester

Domain 6Objective 1

The Impact of Human Behavior on Security Risks CT-SEC Practice Questions (Page 1)

Part of the Human Factors in Security Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

Questions 1–5

1expert · hard
A company wants to reduce the risk of credential theft and insider misuse. The security team is considering implementing a password manager and single sign-on (SSO). Which outcome is the primary security benefit of this approach?
Select an answer first
2foundation · easy
Which psychological principle is most commonly exploited in social engineering attacks?
Select an answer first
3expert · hard
A company is concerned about insider threats. The security team wants to implement controls to detect and prevent both malicious and negligent insider actions. Which combination of controls would be most effective?
Select an answer first
4foundation · easy
Which combination of measures is most effective in reducing the risk of employees falling for phishing emails?
Select an answer first
5expert · hard
A company has a high rate of employees falling for phishing emails. The security team is considering a new training program. Which approach is most likely to reduce the click rate over time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.