A security team is testing a web application that uses a JavaScript-heavy single-page application (SPA) framework. A web application scanner reports no vulnerabilities, but the team suspects the scanner is missing issues because it cannot execute JavaScript. What is the most appropriate action?

Switch to a network protocol fuzzer

Run a host vulnerability scanner on the web server

Accept the scanner results as conclusive

Use a scanner that supports headless browser execution

A developer is testing a web application that uses a REST API with OAuth2 authentication. The developer wants to automate the testing of authorization flaws, such as IDOR (Insecure Direct Object References). Which tool feature is most important?

The ability to perform network port scans

The ability to handle authentication sessions and modify requests

The ability to scan for SQL injection

How do fuzzers generate inputs to test a target application?

By using a predefined list of known vulnerability signatures

By analyzing the application's source code to determine edge cases

By mutating existing valid inputs or generating random data

By replaying captured network packets from previous attacks

A fuzzing campaign on a file parser has produced thousands of crashes. The team has limited time to triage them. Which approach is most efficient for prioritizing which crashes to investigate?

Group crashes by the code path or stack trace and investigate one representative from each group

Report all crashes as separate critical vulnerabilities

Investigate every crash individually

Ignore all crashes and re-run the fuzzer with different seeds

Certified Tester Security Test Engineer

Domain 9Objective 2

Black-Box Security Test Tools CT-STE Practice Questions (Page 2)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 6–10

6expert · hard
A security team is testing a web application that uses a JavaScript-heavy single-page application (SPA) framework. A web application scanner reports no vulnerabilities, but the team suspects the scanner is missing issues because it cannot execute JavaScript. What is the most appropriate action?
Select an answer first
7foundation · easy
Which tool is a network-based black-box security tool used to discover hosts and open ports on a network?
Select an answer first
8application · medium
A developer is testing a web application that uses a REST API with OAuth2 authentication. The developer wants to automate the testing of authorization flaws, such as IDOR (Insecure Direct Object References). Which tool feature is most important?
Select an answer first
9foundation · easy
How do fuzzers generate inputs to test a target application?
Select an answer first
10expert · hard
A fuzzing campaign on a file parser has produced thousands of crashes. The team has limited time to triage them. Which approach is most efficient for prioritizing which crashes to investigate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.