During system security testing, which aspect is most likely to be examined?

The user's perception of the system's usability

The compliance of the system with contractual acceptance criteria

The interaction between the web server, application server, and database in a realistic deployment

The behavior of a single authentication module in a test harness

A healthcare organization is implementing a new patient records system. The security requirements include role-based access control and audit logging of all access to patient data. The organization's compliance officer wants to confirm that these requirements are met and acceptable before the system is deployed. Which security test objective is most relevant for the acceptance testing phase?

Confirming that the security requirements are met and acceptable to the stakeholders.

Identifying all potential vulnerabilities in the system's code.

Verifying that the system can handle the maximum expected load.

Ensuring that the system's user interface is user-friendly.

When evaluating system security test results, what should be considered?

The severity and impact of identified security defects

The user's satisfaction with the system

The performance of individual components

The stakeholders' acceptance of the system

A security test engineer is leading the system-level security testing for a new mobile banking application that integrates with a backend core banking system and a push notification service. The testing must verify that the system correctly handles a man-in-the-middle (MITM) attack on the mobile app's communication with the backend. The engineer has limited time and must choose the most effective approach. Which approach is the most effective for system-level security testing in this scenario?

Test the backend API directly with malicious requests, bypassing the mobile app.

Verify that the push notification service uses TLS encryption.

Review the mobile app's source code for certificate pinning implementation.

Set up a proxy to intercept and modify traffic between the mobile app and the backend to simulate a MITM attack.

Who should be involved in the design of acceptance security tests?

Stakeholders, including business and security representatives

Certified Tester Security Test Engineer

Domain 3Objective 5

System Testing and Acceptance Testing CT-STE Practice Questions (Page 4)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

10 Concepts in This Objective

System Testing in Security Context
Acceptance Testing in Security Context
Security Test Objectives in System Testing
Security Test Objectives in Acceptance Testing
Planning System Security Tests
Planning Acceptance Security Tests
Executing System Security Tests
Executing Acceptance Security Tests
Evaluating System Test Results
Evaluating Acceptance Test Results

Questions 16–20

16foundation · easy
During system security testing, which aspect is most likely to be examined?
Select an answer first
17application · medium
A healthcare organization is implementing a new patient records system. The security requirements include role-based access control and audit logging of all access to patient data. The organization's compliance officer wants to confirm that these requirements are met and acceptable before the system is deployed. Which security test objective is most relevant for the acceptance testing phase?
Select an answer first
18foundation · easy
When evaluating system security test results, what should be considered?
Select an answer first
19expert · hard
A security test engineer is leading the system-level security testing for a new mobile banking application that integrates with a backend core banking system and a push notification service. The testing must verify that the system correctly handles a man-in-the-middle (MITM) attack on the mobile app's communication with the backend. The engineer has limited time and must choose the most effective approach. Which approach is the most effective for system-level security testing in this scenario?
Select an answer first
20foundation · easy
Who should be involved in the design of acceptance security tests?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

System Testing and Acceptance Testing CT-STE Practice Questions (Page 4)

Questions 16–20

During system security testing, which aspect is most likely to be examined?

When evaluating system security test results, what should be considered?

Who should be involved in the design of acceptance security tests?

Keep studying — The Security Test Process