An online education platform stores student grades and personal information. The platform is subject to the Family Educational Rights and Privacy Act (FERPA), which requires that student records be protected. The security team is planning a security test to verify the confidentiality of student data. Which of the following test activities would BEST address the confidentiality principle?

Verifying that the database is backed up daily

Confirming that the application's error messages do not reveal sensitive information

Attempting to access another user's grades by manipulating the URL parameters

Checking that the server's firewall rules are configured correctly

A mobile banking app allows users to transfer money between accounts. The app uses a session token that expires after 10 minutes of inactivity. The security test team is designing test cases for the session management mechanism. Which of the following test cases would MOST effectively verify the security of the session token?

Confirm that the session token is generated using a random algorithm

Attempt to reuse a session token after it has expired

Verify that the session token is transmitted over HTTPS

Check that the session token is stored in a secure location on the device

Certified Tester Advanced Level Technical Test Analyst

Domain 4Objective 1

Security Testing CTAL-TTA Practice Questions (Page 4)

Part of the Domain 4: Quality Characteristics for Technical Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 16–20

16foundation · easy
Which regulation is specifically designed to protect the personal data of individuals within the European Union?
Select an answer first
17application · medium
An online education platform stores student grades and personal information. The platform is subject to the Family Educational Rights and Privacy Act (FERPA), which requires that student records be protected. The security team is planning a security test to verify the confidentiality of student data. Which of the following test activities would BEST address the confidentiality principle?
Select an answer first
18foundation · easy
Which activity is part of security test planning?
Select an answer first
19application · medium
A mobile banking app allows users to transfer money between accounts. The app uses a session token that expires after 10 minutes of inactivity. The security test team is designing test cases for the session management mechanism. Which of the following test cases would MOST effectively verify the security of the session token?
Select an answer first
20foundation · easy
Which security test would verify that data is unreadable to unauthorized parties during transmission?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTAL-TTA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CTAL-TTA” is a trademark of its owner, used for identification only.

Security Testing CTAL-TTA Practice Questions (Page 4)

Questions 16–20

Which regulation is specifically designed to protect the personal data of individuals within the European Union?

Which activity is part of security test planning?

Which security test would verify that data is unreadable to unauthorized parties during transmission?

Keep studying — Domain 4: Quality Characteristics for Technical Testing