A security test engineer is conducting a penetration test on a system that contains highly sensitive research data. The test plan includes using active exploitation techniques that could potentially crash the system. What is the most appropriate action to take?

Use only passive techniques to avoid any risk of system disruption.

Skip the exploitation phase and only report potential vulnerabilities based on scanning.

Coordinate with system owners to schedule the test during a maintenance window and have rollback procedures in place.

Proceed with the test as planned, as the system is in a test environment.

A security test engineer is planning a test for a financial application that processes transactions. The organization has a strict policy that no real customer data may be used in testing. However, the test team needs to validate that the application correctly handles edge cases in transaction amounts. What is the best approach?

Request an exception to the policy for the test team.

Use production data but limit access to the test team.

Use a small set of real customer data with all identifiers removed.

Create synthetic transaction data that includes edge cases and unusual amounts.

Which of the following is a primary reason why a security tester must be aware of legal and regulatory requirements for handling sensitive data during testing?

To avoid violating laws that could result in fines, penalties, or legal liability

To determine the exact number of test cases needed for full coverage

To ensure the test report is formatted according to industry standards

To select the most cost-effective testing tools available

A security test engineer is reviewing the test scope for a system that contains data with different sensitivity levels. The engineer notices that the test plan allocates equal time to all data types. What should the engineer recommend?

Reduce testing on the higher sensitivity data to avoid overloading the system.

Focus on the lower sensitivity data because it is more likely to be attacked.

Allocate more time to testing the higher sensitivity data.

Keep the equal allocation to ensure all data is tested thoroughly.

A security test engineer is working on a project that involves testing a system with data that is classified as 'Restricted' under the organization's classification scheme. The test plan includes exporting data to a third-party testing tool. What must the engineer do first?

Use a secure file transfer protocol to send the data.

Ensure the third-party tool has appropriate security certifications.

Obtain approval from the data owner for the export.

Anonymize the data before exporting it to the tool.

Certified Tester Security Test Engineer

Domain 1Objective 2

Information Sensitivity and Security Testing CT-STE Practice Questions (Page 3)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

3concepts

Questions 11–15

11application · medium
A security test engineer is conducting a penetration test on a system that contains highly sensitive research data. The test plan includes using active exploitation techniques that could potentially crash the system. What is the most appropriate action to take?
Select an answer first
12expert · hard
A security test engineer is planning a test for a financial application that processes transactions. The organization has a strict policy that no real customer data may be used in testing. However, the test team needs to validate that the application correctly handles edge cases in transaction amounts. What is the best approach?
Select an answer first
13foundation · easy
Which of the following is a primary reason why a security tester must be aware of legal and regulatory requirements for handling sensitive data during testing?
Select an answer first
14application · medium
A security test engineer is reviewing the test scope for a system that contains data with different sensitivity levels. The engineer notices that the test plan allocates equal time to all data types. What should the engineer recommend?
Select an answer first
15application · medium
A security test engineer is working on a project that involves testing a system with data that is classified as 'Restricted' under the organization's classification scheme. The test plan includes exporting data to a third-party testing tool. What must the engineer do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.