A security tester wants to anticipate how an attacker might exploit employee trust. Which defensive measure is most directly aligned with this concern?

Conducting security awareness training

Enabling two-factor authentication

A security team is prioritizing security investments. They have identified that their most likely threat is a financially motivated attacker using ransomware. Which security control, aligned with understanding this attacker's mindset, should be the highest priority?

Investing in a robust backup and disaster recovery solution

Purchasing a new firewall with advanced threat prevention

Increasing the security awareness training budget for all employees

Conducting a public relations campaign to improve the company's image

Certified Tester Security Tester

Domain 6Objective 2

Understanding the Attacker Mentality CT-SEC Practice Questions (Page 3)

Part of the Human Factors in Security Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

Questions 11–15

11foundation · easy
A user clicks a link in an email because the subject line says 'Your package is waiting!' even though they weren't expecting a package. Which human factor is being exploited?
Select an answer first
12application · medium
A security analyst notices a series of targeted phishing emails sent to employees in the finance department. The emails reference a recent, non-public merger the company is considering, and the sender impersonates the CEO with a spoofed domain. The goal of the emails is to trick an employee into wiring funds to an external account. Which attack motivation is most clearly driving this campaign?
Select an answer first
13foundation · easy
A security tester wants to anticipate how an attacker might exploit employee trust. Which defensive measure is most directly aligned with this concern?
Select an answer first
14foundation · easy
An attacker sends an email that appears to be from the CEO, urgently requesting the recipient to transfer funds. Which human factor is being exploited?
Select an answer first
15application · medium
A security team is prioritizing security investments. They have identified that their most likely threat is a financially motivated attacker using ransomware. Which security control, aligned with understanding this attacker's mindset, should be the highest priority?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Understanding the Attacker Mentality CT-SEC Practice Questions (Page 3)

Questions 11–15

A user clicks a link in an email because the subject line says 'Your package is waiting!' even though they weren't expecting a package. Which human factor is being exploited?

A security tester wants to anticipate how an attacker might exploit employee trust. Which defensive measure is most directly aligned with this concern?

An attacker sends an email that appears to be from the CEO, urgently requesting the recipient to transfer funds. Which human factor is being exploited?

A security team is prioritizing security investments. They have identified that their most likely threat is a financially motivated attacker using ransomware. Which security control, aligned with understanding this attacker's mindset, should be the highest priority?

Keep studying — Human Factors in Security Testing