If the Runner chooses HQ for and then plays , the Security Testing takes priority.
FAQ 1.5.35 seems incorrect given new understanding of ability types. As ST triggers at 4.4 and Siphon isn't triggered, doesn't ST replace access with creds before Siphon would ever come into play?
This means that Security Testing triggers before Account Siphon ever has a chance to resolve. Security Testing's conditional ability is required, so it replaces the HQ access with gaining 2. By the time the run reaches the access step, Account Siphon can no longer resolve because only one replacement effect can be used per replaced effect.
See the Abilities Explanation Ruling for a more in-depth explanation of the latest understanding on how abilities work.