ISTQB Security Test Process CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does the security test process integrate with the overall test process?

   • AIt replaces the overall test process entirely
   • BIt is aligned with the phases of the overall test process and adds security-specific activities
   • CIt is performed only after the overall test process is complete
   • DIt runs in parallel with the overall test process without any interaction
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security test team is working on a project where the development team is using a new framework that the test team is unfamiliar with. The team must design security tests for the application. What should the team do to ensure the tests are effective?

   • ASkip security testing until the team learns the framework
   • BConduct a threat modeling session to understand the framework's specific attack surface
   • CUse generic security test cases that are not framework-specific
   • DAsk the development team to provide a list of known vulnerabilities in the framework
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial services company is planning security testing for a new mobile banking application. The compliance team requires that all customer data be protected in accordance with PCI DSS, and the development team wants to use a continuous integration pipeline. The security test lead must define the scope and objectives for the security test effort. Which activity should the security test lead perform first?

   • AExecute a preliminary penetration test to identify obvious vulnerabilities
   • BConduct a risk assessment to identify critical assets and potential threats
   • CDesign detailed test cases for each security requirement
   • DSelect and configure automated security scanning tools for the CI pipeline
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When reporting a security vulnerability, what should be included to convey its importance?

   • AThe number of test cases executed
   • BThe total time spent on testing
   • CThe name of the tester who found it
   • DThe severity and impact of the vulnerability
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is developing an IoT device that collects health data. The security test manager must plan security testing for the device firmware and the companion mobile app. The budget is limited, and the team must prioritize testing efforts. What should the test manager do to ensure effective use of resources?

   • AOnly test the mobile app because it is easier to test
   • BPerform a risk assessment to identify the most critical components and focus testing there
   • CTest all components equally to ensure complete coverage
   • DDelay testing until after release to save costs
   Reveal Solution Discussion Select an answer first