ISTQB CT-SEC Certification Exam Sample Questions

CT-SEC Dumps PDF, Security Tester Dumps, download CT - Security Tester free Dumps, ISTQB Security Tester exam questions, free online CT - Security Tester exam questionsYou have to pass the CT-SEC exam to receive the certification from ISTQB. To increase the effectiveness of your study and make you familiar with the actual exam pattern, we have prepared this ISTQB Security Tester sample questions. Our Sample ISTQB Certified Tester Security Tester Practice Exam will give you more insight about both the type and the difficulty level of the questions on the ISTQB CT - Security Tester exam.

However, we are strongly recommending practice with our Premium ISTQB Certified Tester - Security Tester (CT-SEC) Practice Exam to achieve the best score in your actual ISTQB CT-SEC Exam. The premium practice exam questions are more comprehensive, exam oriented, scenario-based and exact match of ISTQB Certified Tester Security Tester exam questions.

ISTQB Security Tester Sample Questions:

01. A confidential security test report has been accidentally emailed to a non-stakeholder.
What is the most immediate step to take?
a) Mention the disclosure in the next scheduled security test status report
b) Recall the report and re-send it with the details removed, so it can be shared more widely
c) Notify the project manager and security staff so it is handled as a security incident
d) Ask the recipient to delete the email, and take no further action
 
02. A test team new to web application security must design tests against the most common attacks on its customer site.
How can a recognized security testing standard help the team most directly?
a) It describes effective defenses and how to test for the most common security attacks
b) It identifies which vulnerabilities the team's own application contains
c) It protects the organization from liability if one of those attacks later succeeds
d) It removes the need for a risk assessment, since the common attacks are already listed in it
 
03. A project is applying a security testing standard agreed with its customer. The team finds that one clause cannot be applied to the system's architecture and decides to modify how it is met.
What must happen for this deviation to be handled properly?
a) Nothing further, since the team applying a standard may tailor it freely without telling anyone
b) The modification is recorded in the final test report after release
c) The team applies the clause as written anyway, because the content of a standard can never be modified
d) The justification for the modification is documented and agreed by all parties
 
04. A team adopting a security testing standard needs to know which of its requirements must be met to claim conformance.
How should the team identify them?
a) By separating the normative "shall" clauses from the informative "should" and "may" clauses.
b) By treating every clause, including those worded "should", as mandatory.
c) By checking the standard's publication date to see whether it still applies.
d) By following the clauses the team already follows and listing the rest as later work.
 
05. A test manager is choosing between two commercial dynamic scanning tools with similar features. The organization's web applications change every month, and new attack techniques are reported frequently.
Which vendor attribute should carry the most weight in this situation?
a) Whether printed manuals are supplied with the tool
b) The hours during which the vendor's helpdesk is available
c) The license types offered, such as fixed or floating licenses
d) How often the vendor updates the tool to cover newly discovered vulnerabilities
 
06. A test manager wants the team's security testing to follow a recognized standard.
Where should the manager look for security testing standards?
a) Standards bodies that publish consensus-based standards
b) The documentation of the security tools the team uses
c) The organization's own past security incident reports
d) Security news services and electronic alert feeds
 
07. A medical device manufacturer's test team proposes adopting a capable, actively maintained open-source fuzzing tool for security testing. The quality manager rejects the proposal even though the tool costs nothing to obtain.
Which reason for rejecting it is most likely?
a) An open-source tool cannot be configured for the specific environment and devices of the organization
b) Its public source code tells attackers what it tests for, so its results cannot be trusted
c) Regulatory compliance obliges the organization to use only commercial or otherwise certified tools
d) Open-source licenses forbid using the tool in the development of a commercial product
 
08. An organization is choosing the security testing standards it will use for a new online banking system.
Which statements about selecting the standards are true?
(Select TWO options.)
a) Standards issued by a regulator apply to every organization, whether or not it works in that regulated sector
b) The organization should research which standards fit its systems, sensitive assets, risk level and compliance needs
c) Not every security standard is appropriate for every system or situation
d) The tool vendor can make the choice, since its products already embody the relevant standards
 
09. Midway through a project, the goals are expanded so that partner companies can access customer records through a new interface. The security acceptance criteria are left unchanged.
What is the most likely consequence?
a) Security testers will have to redo all earlier security tests against the new interface
b) The release is delayed because the old criteria block it until they are revised
c) The system may be accepted without the new partner access path meeting any security criterion
d) Acceptance testing will fail, because the unchanged criteria cannot be evaluated against the new interface
 
10. Which of the following resources is beneficial to understand industry trends in information security?
(Select TWO options.)
a) Specialized security conferences.
b) The previous release's security test plan.
c) Renowned cybersecurity journals.
d) The organization's approved security policy.

Answers:

Question: 01
Answer: c		 Question: 02
Answer: a		 Question: 03
Answer: d		 Question: 04
Answer: a		 Question: 05
Answer: d
Question: 06
Answer: a		 Question: 07
Answer: c		 Question: 08
Answer: b, c		 Question: 09
Answer: c		 Question: 10
Answer: a, c

If you find any errors or typos in ISTQB Certified Tester - Security Tester (CT-SEC) sample question-answers or online ISTQB CT - Security Tester practice exam, please report them to us on feedback@processexam.com

Your rating: None Rating: 5 / 5 (77 votes)