A security tester is part of a post-incident analysis team investigating a SQL injection attack. The team wants to determine why the vulnerability was not caught during development. Which root cause analysis technique would be most appropriate?

Re-run the SQL injection test to confirm the vulnerability is fixed.

Fishbone diagram to categorize potential causes such as training, process, and tooling.

Conduct a brainstorming session with no structure.

Review the attacker's IP address and block it.

During incident response, a security tester needs to collect evidence from a compromised Linux server. The tester wants to ensure the evidence is admissible in court. Which action is most important to take during evidence collection?

Run the evidence collection tools from the compromised system to ensure accuracy.

Create a cryptographic hash of the evidence and document the chain of custody.

Copy all files to a USB drive and store it in a secure location.

Use the original system commands to collect data to avoid altering the system.

What is the primary goal of root cause analysis in the context of a security incident?

To assign blame to a specific individual or team

To document the incident for legal purposes

To identify the underlying reason the incident occurred, not just the immediate cause

To quickly restore services without further investigation

A security tester is collecting evidence from a compromised database server. The tester needs to preserve the evidence for later analysis. Which method is most appropriate?

Run a database backup and store it in the cloud.

Take a screenshot of the database contents.

Copy the database files to a network share.

Create a bit-for-bit image of the hard drive using a write blocker.

What is the primary purpose of the 'lessons learned' section in a post-incident report?

To provide a detailed technical analysis of the attack vectors

To list all the tools used during the incident response

To assign blame to the individuals who caused the incident

To identify what worked well and what needs improvement in the response process

Certified Tester Security Test Engineer

Domain 5Objective 5

Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 6)

Part of the Adjusting To the Organizational Context domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 26–30

26application · medium
A security tester is part of a post-incident analysis team investigating a SQL injection attack. The team wants to determine why the vulnerability was not caught during development. Which root cause analysis technique would be most appropriate?
Select an answer first
27application · medium
During incident response, a security tester needs to collect evidence from a compromised Linux server. The tester wants to ensure the evidence is admissible in court. Which action is most important to take during evidence collection?
Select an answer first
28foundation · easy
What is the primary goal of root cause analysis in the context of a security incident?
Select an answer first
29application · medium
A security tester is collecting evidence from a compromised database server. The tester needs to preserve the evidence for later analysis. Which method is most appropriate?
Select an answer first
30foundation · easy
What is the primary purpose of the 'lessons learned' section in a post-incident report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.