A security tester is evaluating the human factors that contribute to security risks. The tester observes that employees often leave their desks without locking their screens. Which risk does this behavior primarily introduce?

Unauthorized access to sensitive information by passersby

Increased risk of password reuse

Increased risk of phishing attacks

Increased risk of malware infections

A company is implementing a new password policy. The security team wants to balance security with usability. Which policy is most effective in reducing risk while minimizing user frustration?

Require a minimum of 12 characters and implement MFA

Allow users to set any password but require MFA

Require password changes every 30 days and use a password blacklist

Require complex passwords with special characters and numbers

Which scenario is an example of a malicious insider threat?

An employee accidentally sends confidential data to the wrong recipient

An employee clicks a link in a phishing email

An employee steals proprietary data to sell to a competitor

An employee's laptop is stolen from a coffee shop

What is the primary difference between phishing and pretexting?

Phishing uses electronic communication, while pretexting often involves a fabricated scenario that may occur over the phone or in person

Pretexting is a type of malware, while phishing is a social engineering technique

Phishing is used only against individuals, while pretexting is used only against organizations

Phishing always targets passwords, while pretexting targets credit card numbers

Certified Tester Security Tester

Domain 6Objective 1

The Impact of Human Behavior on Security Risks CT-SEC Practice Questions (Page 4)

Part of the Human Factors in Security Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

Questions 16–20

16expert · medium
A security tester is evaluating the human factors that contribute to security risks. The tester observes that employees often leave their desks without locking their screens. Which risk does this behavior primarily introduce?
Select an answer first
17expert · hard
A company is implementing a new password policy. The security team wants to balance security with usability. Which policy is most effective in reducing risk while minimizing user frustration?
Select an answer first
18foundation · easy
Which scenario is an example of a malicious insider threat?
Select an answer first
19foundation · easy
What is the primary difference between phishing and pretexting?
Select an answer first
20application · medium
A disgruntled employee who is about to be laid off copies a large amount of customer data to a personal USB drive before leaving. Which type of insider threat does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.