A security tester is performing a risk identification activity for a new mobile banking application. The tester needs to identify the assets, threats, and vulnerabilities relevant to the system. Which of the following is an example of a vulnerability?

A hacker using a phishing email to steal a user's credentials

The customer's personal data stored in the application database

The mobile application storing user credentials in plain text

The risk of a data breach resulting in regulatory fines

What is the primary purpose of performing a risk assessment in the context of security testing?

To identify, analyze, and evaluate risks so that security testing efforts can be prioritized effectively

To document all possible threats without considering their likelihood or impact

To replace the need for security testing by providing a complete risk register

To guarantee that all vulnerabilities are eliminated before testing begins

A financial services company has a legacy internal application that processes non-critical, non-confidential reports. A risk assessment identifies a critical vulnerability in the application that would require a significant rewrite to fix. The application is scheduled for decommissioning in six months. Management decides not to fix the vulnerability and instead accepts the risk. How should the security testing team proceed?

Perform a focused test to confirm the accepted vulnerability cannot be exploited to reach other systems, then reduce testing effort

Continue testing the application to identify all other vulnerabilities, since the accepted risk does not affect the testing scope

Test the application with the same intensity as before to ensure the vulnerability is not accidentally fixed

Immediately stop all testing on the application because the risk is accepted

A risk assessment identifies that an application's authentication mechanism has a high risk of brute-force attacks. Which test design is most aligned with this risk?

Testing the application's response time under heavy load

Testing the application's backup and recovery procedures

Testing the login page for account lockout and rate limiting

Testing the application's graphical user interface for usability

Certified Tester Security Tester

Domain 1Objective 1

The Role of Risk Assessment in Security Testing CT-SEC Practice Questions (Page 2)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

Questions 6–10

6application · medium
A security tester is performing a risk identification activity for a new mobile banking application. The tester needs to identify the assets, threats, and vulnerabilities relevant to the system. Which of the following is an example of a vulnerability?
Select an answer first
7foundation · easy
What is the primary purpose of performing a risk assessment in the context of security testing?
Select an answer first
8application · medium
A financial services company has a legacy internal application that processes non-critical, non-confidential reports. A risk assessment identifies a critical vulnerability in the application that would require a significant rewrite to fix. The application is scheduled for decommissioning in six months. Management decides not to fix the vulnerability and instead accepts the risk. How should the security testing team proceed?
Select an answer first
9foundation · easy
A risk assessment identifies that an application's authentication mechanism has a high risk of brute-force attacks. Which test design is most aligned with this risk?
Select an answer first
10foundation · easy
An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk treatment option does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

The Role of Risk Assessment in Security Testing CT-SEC Practice Questions (Page 2)

Questions 6–10

A security tester is performing a risk identification activity for a new mobile banking application. The tester needs to identify the assets, threats, and vulnerabilities relevant to the system. Which of the following is an example of a vulnerability?

What is the primary purpose of performing a risk assessment in the context of security testing?

A risk assessment identifies that an application's authentication mechanism has a high risk of brute-force attacks. Which test design is most aligned with this risk?

An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk treatment option does this represent?

Keep studying — The Basis of Security Testing