A security manager is reviewing the results of an internal phishing simulation. The results show that employees in the sales department clicked on a phishing email that offered a free gift card, while employees in the IT department were more likely to click on an email that warned of a security breach. Which conclusion best explains this difference in behavior?

The IT department is more security-conscious and therefore less likely to click on any phishing email

The phishing simulation was flawed and the results are not reliable

Different psychological triggers are more effective on different groups of people

The sales department is less intelligent than the IT department

A security team is designing a new employee onboarding process. They want to reduce the risk of an attacker using publicly available information to craft a convincing spear-phishing email. Which control best addresses this specific risk by limiting the information an attacker can gather?

Establishing a policy to minimize the sharing of internal details on public websites and social media

Conducting quarterly penetration tests on the internal network

Deploying an email gateway that blocks all external emails

Implementing multi-factor authentication (MFA) on all accounts

A security architect is designing a defense strategy for a company that handles sensitive financial data. The architect knows that a sophisticated attacker will likely spend time studying the company's public-facing systems and employees before launching an attack. Which defensive strategy best reflects an understanding of this attacker mindset?

Purchasing cyber insurance to cover potential financial losses

Implementing a 'zero trust' architecture that assumes breach and verifies every request

Focusing solely on deploying the most advanced endpoint detection and response (EDR) tools

Increasing the frequency of vulnerability scans on the internal network

Which statement best describes the attacker mindset in security testing?

Attackers rely on random guessing and luck rather than structured methods to find vulnerabilities.

Attackers only target systems with known, publicly disclosed vulnerabilities.

Attackers focus solely on exploiting technical vulnerabilities and rarely consider human behavior.

Attackers systematically identify weaknesses, assess their value, and determine the most effective way to exploit them.

Certified Tester Security Tester

Domain 6Objective 2

Understanding the Attacker Mentality CT-SEC Practice Questions (Page 2)

Part of the Human Factors in Security Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

Questions 6–10

6expert · hard
A security manager is reviewing the results of an internal phishing simulation. The results show that employees in the sales department clicked on a phishing email that offered a free gift card, while employees in the IT department were more likely to click on an email that warned of a security breach. Which conclusion best explains this difference in behavior?
Select an answer first
7application · medium
A security team is designing a new employee onboarding process. They want to reduce the risk of an attacker using publicly available information to craft a convincing spear-phishing email. Which control best addresses this specific risk by limiting the information an attacker can gather?
Select an answer first
8expert · hard
A security architect is designing a defense strategy for a company that handles sensitive financial data. The architect knows that a sophisticated attacker will likely spend time studying the company's public-facing systems and employees before launching an attack. Which defensive strategy best reflects an understanding of this attacker mindset?
Select an answer first
9foundation · easy
Which statement best describes the attacker mindset in security testing?
Select an answer first
10foundation · easy
After successfully exploiting a vulnerability, what is a common next step in an attack plan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Understanding the Attacker Mentality CT-SEC Practice Questions (Page 2)

Questions 6–10

A security team is designing a new employee onboarding process. They want to reduce the risk of an attacker using publicly available information to craft a convincing spear-phishing email. Which control best addresses this specific risk by limiting the information an attacker can gather?

Which statement best describes the attacker mindset in security testing?

After successfully exploiting a vulnerability, what is a common next step in an attack plan?

Keep studying — Human Factors in Security Testing