A solution architect is designing a new payment processing system and wants to identify potential threats such as spoofing, tampering, and information disclosure before any code is written. The architect needs a systematic way to model the system's data flows and trust boundaries to prioritize security efforts. Which type of tool should be used?

A web application scanner that tests the payment system after deployment

A threat modeling tool that helps create data flow diagrams and identify threats

A penetration testing tool that exploits vulnerabilities in the system

A static analysis tool that scans the source code for vulnerabilities

Certified Tester Security Tester

Domain 8Objective 1

Types and Purposes of Security Testing Tools CT-SEC Practice Questions (Page 9)

Part of the Security Testing Tools domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

14concepts

14 Concepts in This Objective

Static Analysis Tools
Dynamic Analysis Tools
Penetration Testing Tools
Vulnerability Scanning Tools
Fuzzing Tools
Web Application Security Tools
Network Security Tools
Mobile Application Security Tools
Database Security Tools
Code Review Tools
Threat Modeling Tools
Security Information and Event Management (SIEM) Tools
Forensic Tools
Compliance and Audit Tools

Questions 41–43

41foundation · easy
Which type of tool automatically scans systems to detect known vulnerabilities?
Select an answer first
42foundation · easy
Which type of security testing tool analyzes source code without executing the application?
Select an answer first
43application · medium
A solution architect is designing a new payment processing system and wants to identify potential threats such as spoofing, tampering, and information disclosure before any code is written. The architect needs a systematic way to model the system's data flows and trust boundaries to prioritize security efforts. Which type of tool should be used?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Types and Purposes of Security Testing Tools CT-SEC Practice Questions (Page 9)

Questions 41–43

Which type of tool automatically scans systems to detect known vulnerabilities?

Which type of security testing tool analyzes source code without executing the application?

Keep studying — Security Testing Tools