What is the main characteristic of a security procedure?

It is a legal requirement imposed by external regulators on all organizations

It is a technical control such as a firewall rule or an access control list

It is a high-level statement of management intent and security goals

It is a set of step-by-step instructions that specify how to implement a security policy

A security tester discovers a critical vulnerability in a web application. The organization's security policy states that all critical vulnerabilities must be reported to the IT security team within 4 hours. However, the tester is on a tight deadline to complete the test report and decides to wait until the next day to report it. What is the most likely consequence of this action?

The tester will be praised for completing the report first.

The vulnerability will automatically be fixed by the system.

The tester will be required to take a refresher course on security policies.

The tester may face disciplinary action for non-compliance with the policy.

Which of the following is an example of an incident response policy?

Security incidents must be reported to the incident response team within one hour of detection

Employees must not use personal devices for work purposes

All employees must change their passwords every 90 days

Access to sensitive data must be granted only on a need-to-know basis

A security tester is planning a penetration test that involves sending phishing emails to employees. The organization's security policy requires that all security testing activities be approved by the security committee. The tester has received approval, but the policy also states that testing must not cause disruption to business operations. The tester's phishing campaign is scheduled during peak business hours. What should the tester do?

Reschedule the phishing campaign to off-peak hours to minimize disruption.

Cancel the phishing test entirely because it might disrupt operations.

Proceed but only send phishing emails to a small group of employees.

Proceed as planned because the test was approved.

A security tester is writing a report and needs to reference the document that specifies the exact steps for resetting a user's password. Which document should they reference?

The incident response procedure

Certified Tester Security Tester

Domain 1Objective 4

Understanding Security Policies and Procedures CT-SEC Practice Questions (Page 2)

Part of the The Basis of Security Testing domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
What is the main characteristic of a security procedure?
Select an answer first
7application · easy
A security tester discovers a critical vulnerability in a web application. The organization's security policy states that all critical vulnerabilities must be reported to the IT security team within 4 hours. However, the tester is on a tight deadline to complete the test report and decides to wait until the next day to report it. What is the most likely consequence of this action?
Select an answer first
8foundation · easy
Which of the following is an example of an incident response policy?
Select an answer first
9application · medium
A security tester is planning a penetration test that involves sending phishing emails to employees. The organization's security policy requires that all security testing activities be approved by the security committee. The tester has received approval, but the policy also states that testing must not cause disruption to business operations. The tester's phishing campaign is scheduled during peak business hours. What should the tester do?
Select an answer first
10application · easy
A security tester is writing a report and needs to reference the document that specifies the exact steps for resetting a user's password. Which document should they reference?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Understanding Security Policies and Procedures CT-SEC Practice Questions (Page 2)

Questions 6–10

What is the main characteristic of a security procedure?

Which of the following is an example of an incident response policy?

A security tester is writing a report and needs to reference the document that specifies the exact steps for resetting a user's password. Which document should they reference?

Keep studying — The Basis of Security Testing