What should a security tester do when an unexpected behavior or potential security incident occurs during test execution?

Record the details and report it according to the incident handling procedure

Ignore it and continue with the test plan

Immediately delete all test data to prevent further issues

Restart the system and hope the issue does not recur

What is the primary input for designing security test cases?

Threat modeling and security requirements

Lessons learned from previous projects

A security test team has completed executing tests on a web application. They found a vulnerability that allows an attacker to read other users' personal data. The team must report this finding. What is the most important factor to consider when assigning a severity rating?

The time it took to discover the vulnerability

The number of test cases that failed during execution

The potential impact on confidentiality and the likelihood of exploitation

The name of the tester who found the vulnerability

During a security test, a tester finds a vulnerability that appears to be a false positive. The tester is unsure whether the vulnerability is real. What should the tester do?

Analyze the vulnerability further by examining the application's response and source code if available

Ignore the vulnerability because it is likely a false positive

Report the vulnerability as confirmed because it was found by a tool

Ask another tester to re-run the same test without further analysis

After completing a security test cycle, the test lead is preparing the closure report. The team identified several vulnerabilities and provided recommendations. What is a key activity to include in the closure phase?

Conduct a lessons-learned session to capture what went well and what could be improved

Delete all test data and logs to free up storage

Re-test all vulnerabilities to ensure they are fixed

Assign blame for the vulnerabilities found

Certified Tester Security Test Engineer

Domain 3Objective 1

ISTQB Security Test Process CT-STE Practice Questions (Page 4)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 16–20

16foundation · easy
What should a security tester do when an unexpected behavior or potential security incident occurs during test execution?
Select an answer first
17foundation · easy
What is the primary input for designing security test cases?
Select an answer first
18application · medium
A security test team has completed executing tests on a web application. They found a vulnerability that allows an attacker to read other users' personal data. The team must report this finding. What is the most important factor to consider when assigning a severity rating?
Select an answer first
19expert · hard
During a security test, a tester finds a vulnerability that appears to be a false positive. The tester is unsure whether the vulnerability is real. What should the tester do?
Select an answer first
20application · medium
After completing a security test cycle, the test lead is preparing the closure report. The team identified several vulnerabilities and provided recommendations. What is a key activity to include in the closure phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.