Which incident response phase primarily benefits from security testing that identifies weaknesses before an incident occurs, such as vulnerability assessments and red team exercises?

Containment, Eradication, and Recovery

A security tester is performing a penetration test and discovers that a web application is vulnerable to cross-site scripting (XSS). The tester suspects that the vulnerability may have been exploited. What should the tester do to support incident detection?

Exploit the vulnerability further to confirm the impact.

Ignore the vulnerability because it is a common finding.

Fix the vulnerability immediately to prevent exploitation.

Report the vulnerability and any evidence of exploitation to the incident response team.

During which phase of the incident response process does security testing most directly contribute by validating that the containment measures are effective and do not introduce new vulnerabilities?

Containment, Eradication, and Recovery

A security tester is reviewing logs and notices a series of failed login attempts followed by a successful login from an unusual location. The tester suspects a brute-force attack. What should the tester do first to support incident detection and triage?

Change the user's password immediately.

Ignore the event because it is likely a false positive.

Report the finding to the incident response team with relevant log evidence.

Disable the user's account without notifying anyone.

A security tester is assisting with incident response after a suspected insider threat. The tester needs to collect evidence from a laptop that may have been used to exfiltrate data. The laptop is currently powered on and the user is still logged in. Which action should the tester take first?

Power off the laptop immediately to preserve the hard drive.

Copy the user's files to an external drive.

Disconnect the laptop from the network to prevent further data exfiltration.

Capture a memory dump of the laptop.

Certified Tester Security Test Engineer

Domain 5Objective 5

Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 4)

Part of the Adjusting To the Organizational Context domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 16–20

16foundation · easy
Which incident response phase primarily benefits from security testing that identifies weaknesses before an incident occurs, such as vulnerability assessments and red team exercises?
Select an answer first
17application · medium
A security tester is performing a penetration test and discovers that a web application is vulnerable to cross-site scripting (XSS). The tester suspects that the vulnerability may have been exploited. What should the tester do to support incident detection?
Select an answer first
18foundation · easy
During which phase of the incident response process does security testing most directly contribute by validating that the containment measures are effective and do not introduce new vulnerabilities?
Select an answer first
19application · medium
A security tester is reviewing logs and notices a series of failed login attempts followed by a successful login from an unusual location. The tester suspects a brute-force attack. What should the tester do first to support incident detection and triage?
Select an answer first
20expert · hard
A security tester is assisting with incident response after a suspected insider threat. The tester needs to collect evidence from a laptop that may have been used to exfiltrate data. The laptop is currently powered on and the user is still logged in. Which action should the tester take first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.