A security test finds a critical vulnerability in a system that processes personal data. The organization's risk appetite is low, but the system is business-critical and cannot be taken offline. The risk owner must decide on treatment. Which approach best balances risk and business continuity?

Transfer the risk to a third-party vendor by outsourcing the system.

Accept the risk because the system is too important to change.

Take the system offline immediately to eliminate the risk.

Implement compensating controls, such as network segmentation and enhanced monitoring, while planning a permanent fix.

How do security testing activities provide inputs to an ISMS?

By replacing the need for risk assessments within the ISMS.

By providing a final approval for the ISMS implementation.

By automatically fixing all identified security issues without human intervention.

By identifying vulnerabilities and providing findings that inform risk assessments and improvement opportunities.

How does security testing provide evidence for compliance with policies and standards?

By demonstrating that security controls are implemented and effective.

By ensuring that all regulations are followed without exception.

By automatically generating compliance certificates.

By replacing the need for audits.

What is a corrective action that might result from security testing findings?

Conducting a security awareness training session.

Updating the risk assessment methodology.

Patching a vulnerability that was identified during testing.

How does security testing contribute to evaluating the effectiveness of security controls?

By reviewing control documentation only.

By assuming that all implemented controls are effective.

By focusing only on the design of controls, not their implementation.

By attempting to bypass controls to see if they can be defeated.

Certified Tester Security Test Engineer

Domain 7Objective 2

Input for an Information Security Management System (ISMS) CT-STE Practice Questions (Page 6)

Part of the Security Testing as Part of an Information Security Management System domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

Questions 26–30

26expert · hard
A security test finds a critical vulnerability in a system that processes personal data. The organization's risk appetite is low, but the system is business-critical and cannot be taken offline. The risk owner must decide on treatment. Which approach best balances risk and business continuity?
Select an answer first
27foundation · easy
How do security testing activities provide inputs to an ISMS?
Select an answer first
28foundation · easy
How does security testing provide evidence for compliance with policies and standards?
Select an answer first
29foundation · easy
What is a corrective action that might result from security testing findings?
Select an answer first
30foundation · easy
How does security testing contribute to evaluating the effectiveness of security controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.