A fuzzer is used to test a network service and does not find any crashes after several hours. The team concludes the service is secure. Which statement best describes the limitation of this conclusion?

The fuzzer is guaranteed to find all vulnerabilities if run long enough

The fuzzer may not have covered all input combinations or code paths

The service is definitely secure because no crashes occurred

The fuzzer should be replaced with a vulnerability scanner

A network engineer is testing a new VPN gateway that supports IPsec and SSL VPN. The engineer wants to verify that the gateway is not vulnerable to known protocol-level attacks. Which tool category is most appropriate?

A network vulnerability scanner with protocol checks

A web application scanner reports a cross-site scripting (XSS) vulnerability in a search field. The security team manually tests the field and confirms the XSS is real. However, the scanner also reports a 'critical' SQL injection in the same field, but manual testing shows the field is not vulnerable to SQL injection. What is the most likely explanation?

The manual testing was incorrect

The scanner produced a false positive for SQL injection

The scanner missed the XSS and reported it as SQL injection

The scanner is unreliable and should not be used

When choosing a black-box security test tool, which factor should be considered regarding resource constraints?

The tool's popularity among security professionals

The tool's compatibility with the tester's operating system

The tool's ability to generate detailed reports

The tool's licensing cost and hardware requirements

Certified Tester Security Test Engineer

Domain 9Objective 2

Black-Box Security Test Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 1–5

1expert · hard
A fuzzer is used to test a network service and does not find any crashes after several hours. The team concludes the service is secure. Which statement best describes the limitation of this conclusion?
Select an answer first
2application · medium
A network engineer is testing a new VPN gateway that supports IPsec and SSL VPN. The engineer wants to verify that the gateway is not vulnerable to known protocol-level attacks. Which tool category is most appropriate?
Select an answer first
3expert · hard
A web application scanner reports a cross-site scripting (XSS) vulnerability in a search field. The security team manually tests the field and confirms the XSS is real. However, the scanner also reports a 'critical' SQL injection in the same field, but manual testing shows the field is not vulnerable to SQL injection. What is the most likely explanation?
Select an answer first
4foundation · easy
When choosing a black-box security test tool, which factor should be considered regarding resource constraints?
Select an answer first
5application · easy
A network administrator needs to verify that a newly deployed firewall is not exposing any unnecessary services to the internet. The administrator has a list of approved ports and wants to confirm that only those ports are reachable from outside. Which tool should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

Black-Box Security Test Tools CT-STE Practice Questions (Page 1)

Questions 1–5

A fuzzer is used to test a network service and does not find any crashes after several hours. The team concludes the service is secure. Which statement best describes the limitation of this conclusion?

A network engineer is testing a new VPN gateway that supports IPsec and SSL VPN. The engineer wants to verify that the gateway is not vulnerable to known protocol-level attacks. Which tool category is most appropriate?

When choosing a black-box security test tool, which factor should be considered regarding resource constraints?

A network administrator needs to verify that a newly deployed firewall is not exposing any unnecessary services to the internet. The administrator has a list of approved ports and wants to confirm that only those ports are reachable from outside. Which tool should be used?

Keep studying — Security Test Tools