A security tester is asked to support the incident response team during the containment phase of a malware outbreak. What is the tester's most appropriate role?

Provide technical expertise to help identify the malware's propagation methods and potential impact.

Delete all affected files to ensure the malware is removed.

Take over the incident response team's communication with external stakeholders.

Make the final decision on whether to disconnect affected systems.

During initial triage of a potential incident, what is the primary role of security test findings?

To replace the need for log analysis

To provide context about known vulnerabilities and exposures that may have been exploited

To determine the legal liability of the organization

To automatically contain the incident without human intervention

A security tester is writing a post-incident report after a phishing attack that led to credential compromise. The report must help the organization improve its security posture. Which section is most important to include in the report?

An analysis of what went well, what went wrong, and specific recommendations for improvement.

A detailed timeline of the attacker's actions and the evidence collected.

A list of all security tools used during the incident response.

The names of the employees who clicked the phishing link.

Which technique is commonly used in root cause analysis to visually break down a problem into contributing factors, often using a fishbone diagram?

Ishikawa (cause-and-effect) analysis

Certified Tester Security Test Engineer

Domain 5Objective 5

Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 5)

Part of the Adjusting To the Organizational Context domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 21–25

21foundation · easy
Which section of a post-incident report typically describes the sequence of events from detection to resolution?
Select an answer first
22application · medium
A security tester is asked to support the incident response team during the containment phase of a malware outbreak. What is the tester's most appropriate role?
Select an answer first
23foundation · easy
During initial triage of a potential incident, what is the primary role of security test findings?
Select an answer first
24application · medium
A security tester is writing a post-incident report after a phishing attack that led to credential compromise. The report must help the organization improve its security posture. Which section is most important to include in the report?
Select an answer first
25foundation · easy
Which technique is commonly used in root cause analysis to visually break down a problem into contributing factors, often using a fishbone diagram?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.