When prioritizing security tests, what should be considered in addition to risk level?

The personal preferences of the testers.

Available resources, such as time and budget.

The color scheme of the user interface.

The number of lines of code in the system.

A security test engineer is updating the test plan for a new release. The release includes a new authentication module. The engineer needs to incorporate security considerations into the test design documents. What should the engineer do?

Include security test cases only in the test execution report.

Create a separate security test plan that is not part of the main test plan.

Add a section to the test plan that lists security test objectives and related test cases.

Add security test cases to the test plan without any explanation.

Which of the following is an example of a measurable security test objective?

Test that the login function rejects at least 95% of invalid passwords in a test set.

Perform security testing on the application.

Verify that the application is secure.

Ensure that all user inputs are validated.

In risk-based test design, how do security risks identified during analysis primarily influence the test design process?

They are used to select the test environment and tools, but not the test cases.

They are documented but have no direct impact on test design decisions.

They determine the order in which test cases are executed, with higher-risk areas tested first.

They are used to replace all functional test cases with security-specific test cases.

Why is isolation an important aspect of a security test environment?

To reduce the cost of the test environment.

To allow testers to use production data.

To prevent security tests from affecting production systems or other test environments.

To make the test environment identical to production.

Certified Tester Security Test Engineer

Domain 2Objective 3

Addressing Security Risks in Test Design CT-STE Practice Questions (Page 2)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

Questions 6–10

6foundation · easy
When prioritizing security tests, what should be considered in addition to risk level?
Select an answer first
7application · medium
A security test engineer is updating the test plan for a new release. The release includes a new authentication module. The engineer needs to incorporate security considerations into the test design documents. What should the engineer do?
Select an answer first
8foundation · easy
Which of the following is an example of a measurable security test objective?
Select an answer first
9foundation · easy
In risk-based test design, how do security risks identified during analysis primarily influence the test design process?
Select an answer first
10foundation · easy
Why is isolation an important aspect of a security test environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.