How do security testing activities support the objectives of an ISMS?

By replacing the need for risk assessments

By providing evidence of the effectiveness of implemented security controls

By eliminating the need for security awareness training

By guaranteeing that all security incidents will be detected

In a risk-based approach to security testing within an ISMS, what is the primary factor in deciding which systems to test first?

The level of risk associated with each system

The ease of testing each system

The cost of testing each system

The number of vulnerabilities previously found in each system

A security team is planning tests for the upcoming year. The ISMS risk assessment has identified several risks, but the team has limited resources. They must decide which risks to test first. What is the best way to prioritize?

Test risks in the order they were identified in the risk assessment.

Test the risks that are easiest to test, to maximize the number of tests completed.

Test the risks with the highest likelihood of occurrence, regardless of impact.

Prioritize risks based on their risk score, which combines likelihood and impact.

How does security testing contribute to the continual improvement process of an ISMS?

By ensuring that all security controls are implemented without errors

By providing a one-time certification that the ISMS is effective

By eliminating the need for management reviews

By identifying weaknesses and opportunities for improvement in security controls

A security test has revealed a critical vulnerability in a core business application. The application owner wants to delay the fix until the next release cycle, but the risk owner believes it should be fixed immediately. How should the security tester facilitate the decision?

Let the application owner and risk owner resolve it privately without tester involvement.

Escalate the issue to senior management with a clear risk assessment and recommendation.

Support the application owner to avoid disrupting the release schedule.

Implement a temporary workaround without informing the risk owner.

Certified Tester Security Test Engineer

Domain 7Objective 3

Improving Holistic View of an ISMS CT-STE Practice Questions (Page 2)

Part of the Security Testing as Part of an Information Security Management System domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
How do security testing activities support the objectives of an ISMS?
Select an answer first
7foundation · easy
In a risk-based approach to security testing within an ISMS, what is the primary factor in deciding which systems to test first?
Select an answer first
8expert · hard
A security team is planning tests for the upcoming year. The ISMS risk assessment has identified several risks, but the team has limited resources. They must decide which risks to test first. What is the best way to prioritize?
Select an answer first
9foundation · easy
How does security testing contribute to the continual improvement process of an ISMS?
Select an answer first
10expert · hard
A security test has revealed a critical vulnerability in a core business application. The application owner wants to delay the fix until the next release cycle, but the risk owner believes it should be fixed immediately. How should the security tester facilitate the decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.