What is the purpose of prioritizing issues found during security testing?

To make the report longer and more detailed

To satisfy regulatory requirements only

To focus remediation efforts on the most critical risks first

To avoid reporting low-severity issues

A company uses a cloud storage service to store sensitive documents. The security tester is asked to verify that encryption is properly applied. Which finding would be the most critical?

The storage service allows access to the documents without authentication

The documents are also encrypted on the client side before upload

The encryption keys are managed by the cloud provider

The storage service uses server-side encryption with AES-256

A security tester is reviewing the configuration of a web application firewall (WAF). The tester notices that the WAF is not logging blocked requests. What is the most appropriate action?

Ignore the issue because the WAF is blocking traffic

Suggest moving the WAF to detection mode

Report the missing logging as a finding and recommend enabling logging for blocked requests

Recommend disabling the WAF because it is not working correctly

Why is it important to protect security logs from tampering?

To ensure logs can be used as reliable evidence in forensic investigations

To increase the speed of log generation

To reduce the storage space required for logs

Which of the following is an example of protecting data in transit?

Encrypting a database file on disk

Setting file permissions on a shared folder

Using a firewall to filter traffic

Using TLS to encrypt communication between a client and a server

Certified Tester Security Test Engineer

Domain 2Objective 7

Testing Protective Technologies CT-STE Practice Questions (Page 4)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

Questions 16–20

16foundation · easy
What is the purpose of prioritizing issues found during security testing?
Select an answer first
17application · medium
A company uses a cloud storage service to store sensitive documents. The security tester is asked to verify that encryption is properly applied. Which finding would be the most critical?
Select an answer first
18application · medium
A security tester is reviewing the configuration of a web application firewall (WAF). The tester notices that the WAF is not logging blocked requests. What is the most appropriate action?
Select an answer first
19foundation · easy
Why is it important to protect security logs from tampering?
Select an answer first
20foundation · easy
Which of the following is an example of protecting data in transit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.