If reconciliation testing reveals a configuration drift, what is an appropriate follow-up action?

Remediate the configuration to match the baseline

Immediately recertify the system

Ignore the drift if the system is still working

Delete the baseline and create a new one

After a security incident, which testing activity is most appropriate?

Recertification testing to re-validate the entire system certification

Performance testing to ensure the system is fast

Reconciliation testing to verify that controls are back to the baseline

Usability testing to check user experience

What is the primary activity during execution of recertification testing?

Reviewing the system's user documentation

Comparing the current configuration to the baseline

Re-running relevant security tests that were part of the original certification

Applying security patches to the system

A financial services company has a core banking application that was certified against internal security standards six months ago. The application recently underwent a major upgrade that added a new authentication module and changed the session management logic. The security team must confirm the system still meets the original certification criteria. Which type of testing should the team perform?

Penetration testing to identify new vulnerabilities introduced by the upgrade

Recertification testing to re-run the security tests that were part of the original certification

Reconciliation testing to compare the current configuration against the documented baseline

Regression testing to ensure that existing functionality still works after the upgrade

Which activity is part of planning recertification testing?

Comparing the current configuration to the baseline

Reviewing audit logs for security incidents

Selecting appropriate test techniques based on the system's risk profile

Certified Tester Security Test Engineer

Domain 2Objective 4

Recertification Testing and Reconciliation Testing CT-STE Practice Questions (Page 5)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

10concepts

10 Concepts in This Objective

Recertification testing definition
Reconciliation testing definition
When to perform recertification testing
When to perform reconciliation testing
Differences between recertification and reconciliation testing
Planning recertification testing
Planning reconciliation testing
Executing recertification testing
Executing reconciliation testing
Reporting and follow-up actions

Questions 21–25

21foundation · easy
If reconciliation testing reveals a configuration drift, what is an appropriate follow-up action?
Select an answer first
22foundation · easy
After a security incident, which testing activity is most appropriate?
Select an answer first
23foundation · easy
What is the primary activity during execution of recertification testing?
Select an answer first
24application · medium
A financial services company has a core banking application that was certified against internal security standards six months ago. The application recently underwent a major upgrade that added a new authentication module and changed the session management logic. The security team must confirm the system still meets the original certification criteria. Which type of testing should the team perform?
Select an answer first
25foundation · easy
Which activity is part of planning recertification testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.