A development team is using test-driven development (TDD) to build a new encryption component. Which security testing activity should be integrated into the TDD process?

Use a fuzzing tool to generate random inputs for the component after it is implemented.

Write a failing test that verifies the component rejects weak encryption keys before implementing the encryption logic.

Wait until the component is fully implemented and then run a penetration test against it.

Perform a code review after the component is implemented to look for security flaws.

Which of the following is a key focus for security test design at the component integration level?

The component's unit test coverage

The component's internal error messages

Authentication and authorization across components

The component's variable naming conventions

After running component-level security tests on a file upload module, the test results show that the module accepts files with double extensions (e.g., 'malware.php.jpg'). The module is supposed to reject such files. What should the tester do next?

Retest the module with a different set of test cases to see if the issue persists.

Classify the finding as a false positive because the module is not responsible for file execution.

Ignore the finding because double extensions are a common and acceptable practice.

Report the finding as a vulnerability and recommend a fix to the development team.

What does the analysis of component-level security test results help to assess?

The component's code readability

The component's user-friendliness

The effectiveness of security controls

Certified Tester Security Tester

Domain 4Objective 3

Component and Integration Testing CT-SEC Practice Questions (Page 1)

Part of the Security Testing Throughout the Software Lifecycle domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

5concepts

Questions 1–5

1application · medium
A development team is using test-driven development (TDD) to build a new encryption component. Which security testing activity should be integrated into the TDD process?
Select an answer first
2foundation · easy
Which of the following is a key focus for security test design at the component integration level?
Select an answer first
3foundation · easy
Which of the following is a key aspect of security test design at the component level?
Select an answer first
4application · medium
After running component-level security tests on a file upload module, the test results show that the module accepts files with double extensions (e.g., 'malware.php.jpg'). The module is supposed to reject such files. What should the tester do next?
Select an answer first
5foundation · easy
What does the analysis of component-level security test results help to assess?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.