What is the primary factor that determines the strength of an encryption algorithm against brute-force attacks?

The complexity of the plaintext

The speed of the encryption process

A security tester is reviewing a system that uses digital signatures to ensure the integrity of software updates. The tester discovers that the system uses the same RSA key pair for both signing and encryption. What is the most significant risk?

An attacker could use the public key to forge a digital signature.

The key is more likely to be compromised because it is used for two purposes.

The digital signature will be weaker because the key is also used for encryption.

An attacker could trick the system into decrypting a message that was meant to be signed, leading to a loss of confidentiality.

What is the purpose of key revocation in key management?

To encrypt data with a different algorithm

To invalidate a key that is compromised or no longer trusted

To back up keys to a secure location

A security tester is testing a web server's TLS configuration. The tester wants to verify that the server is not vulnerable to the Heartbleed bug. What is the most effective way to test for this?

Use a vulnerability scanner that specifically checks for the Heartbleed vulnerability.

Attempt to connect to the server using an outdated TLS version.

Check the server's TLS version and cipher suite configuration.

Review the server's SSL certificate to see if it is expired.

Certified Tester Security Test Engineer

Domain 2Objective 6

Encryption CT-STE Practice Questions (Page 5)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

Questions 21–25

21foundation · easy
What is the primary factor that determines the strength of an encryption algorithm against brute-force attacks?
Select an answer first
22expert · medium
A security tester is reviewing a system that uses digital signatures to ensure the integrity of software updates. The tester discovers that the system uses the same RSA key pair for both signing and encryption. What is the most significant risk?
Select an answer first
23foundation · easy
What is the purpose of key revocation in key management?
Select an answer first
24application · medium
A security tester is testing a web server's TLS configuration. The tester wants to verify that the server is not vulnerable to the Heartbleed bug. What is the most effective way to test for this?
Select an answer first
25foundation · easy
During a security review, a tester finds that a password is stored as a fixed-length string that cannot be reversed to obtain the original password. Which cryptographic concept is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.