A financial services company has just completed a penetration test that found and fixed several critical vulnerabilities. The compliance officer now requests a formal review to verify that the fixes were implemented correctly and that the organization's security controls align with PCI DSS requirements. Which activity should the team perform?

Conduct a security audit to evaluate the effectiveness of controls against the PCI DSS criteria

Perform a vulnerability scan on the affected systems to check for residual weaknesses

Review the penetration test report and close the findings without further action

Run another penetration test to confirm the vulnerabilities are no longer exploitable

What is typically included in the structure of a security audit report?

A list of all security tools used by the organization

A step-by-step guide for exploiting vulnerabilities

A list of all employee passwords

Executive summary, findings, and recommendations

Which statement best describes the outcome of security testing?

A list of vulnerabilities with associated risks

A detailed financial audit report

A guarantee that the system is secure

What is the primary role of security testing?

To evaluate compliance with regulatory standards

To identify vulnerabilities in systems and applications

To assign security ratings to employees

To replace the need for security audits

A software company wants to reduce the cost and effort of fixing security vulnerabilities. Currently, security testing is performed only after the application is fully developed. Which change to the SDLC would BEST address this issue?

Performing a single, comprehensive penetration test after development is complete

Integrating security testing into each phase of the SDLC, starting from requirements

Conducting security testing only when a vulnerability is reported by customers

Outsourcing all security testing to an external vendor

Certified Tester Security Test Engineer

Domain 1Objective 3

Security Audits and Security Testing CT-STE Practice Questions (Page 5)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 21–25

21application · medium
A financial services company has just completed a penetration test that found and fixed several critical vulnerabilities. The compliance officer now requests a formal review to verify that the fixes were implemented correctly and that the organization's security controls align with PCI DSS requirements. Which activity should the team perform?
Select an answer first
22foundation · easy
What is typically included in the structure of a security audit report?
Select an answer first
23foundation · easy
Which statement best describes the outcome of security testing?
Select an answer first
24foundation · easy
What is the primary role of security testing?
Select an answer first
25application · medium
A software company wants to reduce the cost and effort of fixing security vulnerabilities. Currently, security testing is performed only after the application is fully developed. Which change to the SDLC would BEST address this issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.