Which of the following is an example of a security requirement that supports vulnerability avoidance?

The system must validate all user input before processing

The system must be easy to maintain

The system must be user-friendly and intuitive

The system must be fast and responsive

Which activity is an example of integrating security testing into an early phase of development?

Monitoring production logs for security incidents

Conducting a security review of the design documents

Performing penetration testing on the final release

Deploying a web application firewall after launch

Why is it important to document vulnerabilities in a centralized repository?

To replace the need for security testing

To ensure that vulnerabilities are tracked, prioritized, and not forgotten

To hide vulnerabilities from external auditors

To automatically fix the vulnerabilities

A security tester is reviewing a Java web application that constructs SQL queries by concatenating user input directly into the query string. Which vulnerability is most likely present, and what is the most effective avoidance strategy?

SQL injection; use prepared statements with parameterized queries.

Insecure deserialization; validate input before deserializing.

Cross-site scripting; encode all output before rendering.

Buffer overflow; use safer string functions in Java.

Certified Tester Security Test Engineer

Domain 8Objective 4

Avoid Vulnerability CT-STE Practice Questions (Page 3)

Part of the Reporting Test Results domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 11–15

11foundation · easy
Which of the following is an example of a security requirement that supports vulnerability avoidance?
Select an answer first
12foundation · easy
Which activity is an example of integrating security testing into an early phase of development?
Select an answer first
13foundation · easy
Why is it important to document vulnerabilities in a centralized repository?
Select an answer first
14foundation · easy
Which vulnerability type is characterized by an attacker injecting malicious scripts into web pages viewed by other users?
Select an answer first
15application · medium
A security tester is reviewing a Java web application that constructs SQL queries by concatenating user input directly into the query string. Which vulnerability is most likely present, and what is the most effective avoidance strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.