ISTQB Security Test Process CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security test team has completed testing and found a vulnerability that could allow an attacker to access sensitive data. The team must report this finding to management, but management is concerned about the cost of fixing the vulnerability. What should the team include in the report to help management make an informed decision?

   • AOnly the technical details of the vulnerability
   • BA cost-benefit analysis that compares the cost of remediation with the potential impact of a breach
   • CA recommendation to ignore the vulnerability because fixing it is expensive
   • DA list of all vulnerabilities found, without prioritization
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a key activity in security test planning?

   • AAnalyzing test results to determine vulnerabilities
   • BExecuting security test cases
   • CDefining the scope and objectives of security testing
   • DSummarizing lessons learned for future projects
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a security test, a tester attempts to exploit a SQL injection vulnerability. The application returns a generic error message, but the tester suspects the injection is working because of a time delay. What should the tester do to confirm the vulnerability?

   • AChange the test to a different vulnerability because SQL injection is not working
   • BReport the vulnerability as confirmed based on the initial suspicion
   • CUse a time-based injection payload and measure the response time to confirm the delay
   • DStop testing because the generic error message indicates the application is secure
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of an attack vector that should be considered during security test design?

   • ATest environment setup
   • BSQL injection
   • CRequirement traceability matrix
   • DUser acceptance testing
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following best describes the overall ISTQB security test process?

   • AA set of phases that includes planning, design, execution, evaluation, and closure, integrated with the overall test process
   • BA linear sequence of activities performed only after the system is fully deployed
   • CA collection of independent activities performed by security specialists without coordination with other test activities
   • DA single phase that focuses solely on vulnerability scanning and penetration testing
   Reveal Solution Discussion Select an answer first