A security test has identified a critical vulnerability in a legacy system. The system owner is resistant to fixing it due to cost. How should the security tester communicate this finding within the ISMS framework?

Immediately fix the vulnerability without consulting the system owner.

Present the risk to the risk owner and recommend a risk treatment option, such as mitigation or acceptance.

Keep the finding confidential to avoid conflict with the system owner.

Report the vulnerability to the system owner and let them decide without further escalation.

An organization is planning to integrate security testing into its ISMS continual improvement process. They have a limited budget and need to demonstrate improvement over time. What is the most effective approach?

Conduct a single comprehensive test at the end of each year to measure improvement.

Focus on fixing vulnerabilities found in the last test and assume improvement.

Establish a baseline, then conduct regular tests and track metrics to show trends.

Use external testers only, as they provide an unbiased view of improvement.

How should security testing recommendations be presented to senior management in an ISMS context?

In terms of business risk and impact, with prioritized actions

As a list of all technical vulnerabilities found, regardless of risk

Only as a pass/fail result of the security test

As a detailed technical report with all exploit details

Certified Tester Security Test Engineer

Domain 7Objective 3

Improving Holistic View of an ISMS CT-STE Practice Questions (Page 1)

Part of the Security Testing as Part of an Information Security Management System domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

Questions 1–5

1application · medium
A security test has identified a critical vulnerability in a legacy system. The system owner is resistant to fixing it due to cost. How should the security tester communicate this finding within the ISMS framework?
Select an answer first
2foundation · easy
In which ISMS process does security testing provide input for the selection of security controls?
Select an answer first
3foundation · easy
Which ISMS process is directly supported by the results of security testing?
Select an answer first
4expert · hard
An organization is planning to integrate security testing into its ISMS continual improvement process. They have a limited budget and need to demonstrate improvement over time. What is the most effective approach?
Select an answer first
5foundation · easy
How should security testing recommendations be presented to senior management in an ISMS context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

Improving Holistic View of an ISMS CT-STE Practice Questions (Page 1)

Questions 1–5

A security test has identified a critical vulnerability in a legacy system. The system owner is resistant to fixing it due to cost. How should the security tester communicate this finding within the ISMS framework?

In which ISMS process does security testing provide input for the selection of security controls?

Which ISMS process is directly supported by the results of security testing?

An organization is planning to integrate security testing into its ISMS continual improvement process. They have a limited budget and need to demonstrate improvement over time. What is the most effective approach?

How should security testing recommendations be presented to senior management in an ISMS context?

Keep studying — Security Testing as Part of an Information Security Management System