After a security test project, the test manager is preparing the closure report. The project faced several challenges, including incomplete requirements and tight deadlines. What should the closure report emphasize to benefit future projects?

A summary of the vulnerabilities found, without context

A detailed list of all test cases executed

An analysis of the test team's performance and individual contributions

Lessons learned about the impact of incomplete requirements and how to mitigate them

Why is it important to document lessons learned during security test closure?

To replace the need for security test planning

To assign blame for any failures

To increase the number of test cases in the next cycle

To improve future security testing activities

A security test team has completed testing a web application and found several vulnerabilities. The team must report the findings to stakeholders. Which approach is most effective for communicating the results?

Provide a summary that only lists the number of vulnerabilities found

Provide a report that only includes the technical details of each vulnerability

Provide a detailed report with severity ratings, impact descriptions, and recommended fixes

Provide a verbal presentation without any written documentation

What is the primary purpose of performing a risk assessment during security test planning?

To determine the exact number of test cases needed

To replace the need for security test design

To ensure that all security test cases are executed

To identify and prioritize security test activities based on potential impact

A security test team is planning tests for a new e-commerce platform. The platform processes credit card payments and stores customer information. The team must ensure compliance with PCI DSS. What should the team include in the security test plan?

Specific test objectives related to PCI DSS requirements, such as encryption and access control

A plan to test only the payment processing module

A list of all possible attack vectors, regardless of relevance

A detailed schedule for each test case without considering compliance

Certified Tester Security Test Engineer

Domain 3Objective 1

ISTQB Security Test Process CT-STE Practice Questions (Page 5)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 21–25

21expert · hard
After a security test project, the test manager is preparing the closure report. The project faced several challenges, including incomplete requirements and tight deadlines. What should the closure report emphasize to benefit future projects?
Select an answer first
22foundation · easy
Why is it important to document lessons learned during security test closure?
Select an answer first
23application · medium
A security test team has completed testing a web application and found several vulnerabilities. The team must report the findings to stakeholders. Which approach is most effective for communicating the results?
Select an answer first
24foundation · easy
What is the primary purpose of performing a risk assessment during security test planning?
Select an answer first
25application · medium
A security test team is planning tests for a new e-commerce platform. The platform processes credit card payments and stores customer information. The team must ensure compliance with PCI DSS. What should the team include in the security test plan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.