A security audit has identified a critical vulnerability in a customer-facing application. The audit report is being finalized. The organization's management wants to delay the release of the report until the vulnerability is fixed, to avoid negative publicity. What is the BEST course of action for the audit team?

Issue the report with the finding and include a recommended remediation timeline

Delay the report until the vulnerability is fixed, as requested by management

Remove the critical finding from the report to avoid negative publicity

Issue the report only to management and keep the finding confidential

Why is follow-up action important after a security audit?

To repeat the audit immediately

To ensure that identified issues are addressed and resolved

To assign blame for audit findings

What is a key difference between a security audit and security testing?

Audits are always automated, while testing is always manual

Audits are performed only by external parties, while testing is performed only by internal teams

Audits produce vulnerability lists, while testing produces compliance reports

Audits evaluate compliance with criteria, while testing identifies exploitable vulnerabilities

What is a benefit of integrating security testing into the SDLC?

It allows for early detection and remediation of vulnerabilities

It eliminates the need for security audits

It reduces the need for developer training

It guarantees the software will be free of vulnerabilities

Certified Tester Security Test Engineer

Domain 1Objective 3

Security Audits and Security Testing CT-STE Practice Questions (Page 2)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 6–10

6expert · hard
A security audit has identified a critical vulnerability in a customer-facing application. The audit report is being finalized. The organization's management wants to delay the release of the report until the vulnerability is fixed, to avoid negative publicity. What is the BEST course of action for the audit team?
Select an answer first
7foundation · easy
Why is follow-up action important after a security audit?
Select an answer first
8foundation · easy
What is a key difference between a security audit and security testing?
Select an answer first
9foundation · easy
What is a benefit of integrating security testing into the SDLC?
Select an answer first
10foundation · easy
Which phase of a security audit involves gathering evidence and evaluating controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

Security Audits and Security Testing CT-STE Practice Questions (Page 2)

Questions 6–10

Why is follow-up action important after a security audit?

What is a key difference between a security audit and security testing?

What is a benefit of integrating security testing into the SDLC?

Which phase of a security audit involves gathering evidence and evaluating controls?

Keep studying — Security Paradigms