Which description best captures a security test plan's content?

• A. Scope and objectives only.
• B. Schedule, resources, and roles.
• C. Environment and tools.
• D. Scope, objectives, test strategy, resources, schedule, roles, automated and manual test cases, environment, tools, risk, and entry/exit criteria.

Answer: (D)

A security test plan should lay out what will be tested, why, and how the testing will be carried out. This includes defining the scope and objectives so everyone understands which systems, components, and risks are in play and what success looks like. A clear test strategy describes the overall approach—what kinds of security testing will be used (such as static analysis, dynamic testing, penetration testing, threat modeling), how risks will be prioritized, and how testing activities will be conducted to achieve those objectives.

Details about resources, schedule, and roles ensure the right people, time, and constraints are in place, so the plan is executable and coordinated. Including automated and manual test cases provides concrete, actionable steps for verification, showing not only what is tested but how it will be tested and what constitutes pass or fail. Specifying the environment and tools clarifies where tests run, what configurations are required, and which tooling will be used to detect vulnerabilities.

Incorporating risk helps prioritize testing efforts toward the most significant threats, while entry and exit criteria establish the conditions for starting and concluding testing, including what evidence must be produced and what risk thresholds must be met. Taken together, these elements create a complete blueprint for planning, executing, and closing a security testing effort.

Focusing on only one or two aspects—such as scope and objectives, or schedule and roles, or environment and tools—omits essential planning and governance, which is why a full, integrated description is the best fit.