A security tester is about to run a penetration test on a system that processes credit card data. Which of the following actions best aligns with secure testing practices in a sensitive environment?

Run the test during peak business hours to observe real user behavior

Skip logging to avoid storing sensitive data in test logs

Obtain written authorization and define the scope of testing before starting

Use real credit card numbers to test the system's validation logic accurately

A security test engineer is about to perform a test that involves sending sensitive data to an external test lab. The organization has a data handling policy that requires data to be encrypted during transfer. What is the most important thing the engineer should verify?

The data is encrypted using a strong algorithm such as AES-256.

The external lab has a valid SSL certificate.

The transfer method uses encryption that complies with the organization's policy.

The external lab has signed a non-disclosure agreement.

When performing security testing on a system that contains highly sensitive data, which of the following is a recommended safeguard to apply during the test?

Use production data without any modification to ensure test accuracy

Conduct the test on a cloned environment that is isolated from the production network

Disable all logging during the test to avoid creating sensitive data records

Share test results with all team members immediately, including those not involved in the test

A security test engineer is developing a test strategy for a system that handles personal data. The system is subject to both GDPR and internal policies that require data minimization. The test team wants to use production data for realistic testing. What is the best approach?

Use synthetic data that is generated based on the production data's statistical properties.

Use production data but pseudonymize it to reduce the risk of re-identification.

Use a subset of production data that is necessary for the test scenarios.

Use production data but restrict access to the test team.

A security test engineer is testing a system that stores health records. The organization is subject to HIPAA. The test team wants to use real patient data for testing. What is the most appropriate action?

Obtain authorization from the organization's privacy officer to use real data.

Use de-identified patient data that meets the HIPAA de-identification standard.

Use real patient data but ensure it is encrypted in transit and at rest.

Use a subset of real data that is necessary for the test.

Certified Tester Security Test Engineer

Domain 1Objective 2

Information Sensitivity and Security Testing CT-STE Practice Questions (Page 2)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

3concepts

Questions 6–10

6foundation · easy
A security tester is about to run a penetration test on a system that processes credit card data. Which of the following actions best aligns with secure testing practices in a sensitive environment?
Select an answer first
7application · medium
A security test engineer is about to perform a test that involves sending sensitive data to an external test lab. The organization has a data handling policy that requires data to be encrypted during transfer. What is the most important thing the engineer should verify?
Select an answer first
8foundation · easy
When performing security testing on a system that contains highly sensitive data, which of the following is a recommended safeguard to apply during the test?
Select an answer first
9expert · hard
A security test engineer is developing a test strategy for a system that handles personal data. The system is subject to both GDPR and internal policies that require data minimization. The test team wants to use production data for realistic testing. What is the best approach?
Select an answer first
10application · medium
A security test engineer is testing a system that stores health records. The organization is subject to HIPAA. The test team wants to use real patient data for testing. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.