Why is it important to integrate security testing early in the development process?

To replace the need for security requirements analysis

To satisfy regulatory compliance only

To identify and fix vulnerabilities when they are less expensive to address

To ensure that the system is completely free of vulnerabilities

Which coding practice is specifically designed to prevent cross-site scripting (XSS) vulnerabilities?

Setting secure flags on cookies

Implementing role-based access control (RBAC)

Validating and encoding all user-supplied data before rendering it in web pages

Using strong encryption for data at rest

A development team is planning a new microservices-based application. They want to avoid introducing vulnerabilities during the SDLC. The team has limited security expertise and a tight budget. Which combination of strategies is most effective for vulnerability avoidance?

Relying on a single comprehensive penetration test after the application is deployed.

Outsourcing all security testing to an external vendor to avoid building internal expertise.

Providing developers with secure coding training and integrating SAST tools into the CI pipeline.

Conducting a full threat modeling exercise for each microservice and implementing all identified mitigations.

A developer is writing a function in C that copies a user-supplied string into a fixed-size buffer. Which secure coding practice should the developer apply to avoid a buffer overflow vulnerability?

Use gets() and check the return value for errors.

Use strncpy() with the size of the destination buffer as the limit.

Use strcpy() and ensure the source string is null-terminated.

Use snprintf() with the size of the destination buffer as the limit.

Which practice is an example of a vulnerability avoidance strategy during the design phase?

Applying security requirements and threat modeling during design

Performing a security code review after the code is written

Installing a firewall after deployment

Running penetration tests on the final release

Certified Tester Security Test Engineer

Domain 8Objective 4

Avoid Vulnerability CT-STE Practice Questions (Page 6)

Part of the Reporting Test Results domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 26–30

26foundation · easy
Why is it important to integrate security testing early in the development process?
Select an answer first
27foundation · easy
Which coding practice is specifically designed to prevent cross-site scripting (XSS) vulnerabilities?
Select an answer first
28expert · hard
A development team is planning a new microservices-based application. They want to avoid introducing vulnerabilities during the SDLC. The team has limited security expertise and a tight budget. Which combination of strategies is most effective for vulnerability avoidance?
Select an answer first
29application · medium
A developer is writing a function in C that copies a user-supplied string into a fixed-size buffer. Which secure coding practice should the developer apply to avoid a buffer overflow vulnerability?
Select an answer first
30foundation · easy
Which practice is an example of a vulnerability avoidance strategy during the design phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.