Which statement best describes the primary purpose of a security audit?

To systematically evaluate an organization's security posture against defined criteria

To actively exploit vulnerabilities in a live system to demonstrate impact

To develop new security software and tools for the organization

To continuously monitor network traffic for real-time threat detection

A development team is using an agile methodology with two-week sprints. The security team wants to integrate security testing into the SDLC without slowing down the development process. Which approach BEST balances security and development speed?

Defer all security testing until the final release

Conduct a security audit at the end of each sprint

Automate security testing tools to run during each sprint's continuous integration pipeline

Perform a full penetration test at the end of each sprint

A development team is about to release a new web application. The security team wants to identify vulnerabilities in the application's code before it goes live. Which security testing technique is MOST appropriate for this task?

Running a social engineering test against employees

Performing a network vulnerability scan of the production environment

Reviewing the firewall configuration for open ports

Conducting a code review to examine the source code for security flaws

At which stage of the SDLC should security testing ideally begin?

Only after the software is in production

Certified Tester Security Test Engineer

Domain 1Objective 3

Security Audits and Security Testing CT-STE Practice Questions (Page 3)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 11–15

11foundation · easy
Which technique is commonly used to identify known vulnerabilities in systems?
Select an answer first
12foundation · easy
Which statement best describes the primary purpose of a security audit?
Select an answer first
13expert · hard
A development team is using an agile methodology with two-week sprints. The security team wants to integrate security testing into the SDLC without slowing down the development process. Which approach BEST balances security and development speed?
Select an answer first
14application · medium
A development team is about to release a new web application. The security team wants to identify vulnerabilities in the application's code before it goes live. Which security testing technique is MOST appropriate for this task?
Select an answer first
15foundation · easy
At which stage of the SDLC should security testing ideally begin?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.