A security testing team is looking to adopt a new technology that uses runtime analysis to automatically detect and block malicious behavior in applications without requiring source code access. This technology is often highlighted at security conferences as a modern alternative to traditional signature-based detection. Which technology are they considering?

Runtime Application Self-Protection (RASP)

Static Application Security Testing (SAST)

A security testing team is reviewing recent industry reports that highlight a significant increase in ransomware attacks targeting backup repositories. To ensure their testing methodology addresses this emerging threat, what should the team prioritize adding to their test plan?

Testing the physical security of the data center

Testing the usability of the user interface

Testing the security of backup storage and restoration processes

Testing the performance of the web application firewall

How has the increasing adoption of cloud computing influenced security testing priorities?

It has made security testing irrelevant because cloud providers are fully responsible for security.

It has shifted all security testing to physical penetration testing of data centers.

It has eliminated the need to test for network security.

It has increased the focus on testing cloud-specific configurations and identity management.

A security testing team is developing a new testing strategy for a client that is migrating to a serverless architecture. The team has identified that the client's developers are new to serverless and may introduce misconfigurations in the deployment templates. The team must choose between focusing their testing efforts on the application code or on the infrastructure-as-code (IaC) templates. The client has a limited budget and wants to minimize the risk of a security breach. What should the team prioritize?

Split the budget equally between testing application code and IaC templates

Prioritize testing the application code for vulnerabilities

Prioritize testing the IaC templates for misconfigurations

Focus on runtime monitoring instead of pre-deployment testing

Certified Tester Security Tester

Domain 9Objective 5

Where to Learn of Industry Trends in Information Security CT-SEC Practice Questions (Page 2)

Part of the Standards and Industry Trends domain, which makes up ~11% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 6–10

6application · medium
A security testing team is looking to adopt a new technology that uses runtime analysis to automatically detect and block malicious behavior in applications without requiring source code access. This technology is often highlighted at security conferences as a modern alternative to traditional signature-based detection. Which technology are they considering?
Select an answer first
7application · medium
A security testing team is reviewing recent industry reports that highlight a significant increase in ransomware attacks targeting backup repositories. To ensure their testing methodology addresses this emerging threat, what should the team prioritize adding to their test plan?
Select an answer first
8foundation · easy
How has the increasing adoption of cloud computing influenced security testing priorities?
Select an answer first
9expert · hard
A security testing team is developing a new testing strategy for a client that is migrating to a serverless architecture. The team has identified that the client's developers are new to serverless and may introduce misconfigurations in the deployment templates. The team must choose between focusing their testing efforts on the application code or on the infrastructure-as-code (IaC) templates. The client has a limited budget and wants to minimize the risk of a security breach. What should the team prioritize?
Select an answer first
10application · easy
A security tester is preparing a presentation for a non-technical audience on the current state of cybersecurity. The tester wants to use a source that provides a high-level overview of the most common attack patterns and security weaknesses. Which source is best suited for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Where to Learn of Industry Trends in Information Security CT-SEC Practice Questions (Page 2)

Questions 6–10

A security testing team is reviewing recent industry reports that highlight a significant increase in ransomware attacks targeting backup repositories. To ensure their testing methodology addresses this emerging threat, what should the team prioritize adding to their test plan?

How has the increasing adoption of cloud computing influenced security testing priorities?

A security tester is preparing a presentation for a non-technical audience on the current state of cybersecurity. The tester wants to use a source that provides a high-level overview of the most common attack patterns and security weaknesses. Which source is best suited for this purpose?

Keep studying — Standards and Industry Trends