What is a common limitation of black-box security test tools?

They require access to the application's source code to function

They are unable to test network services

They can only test applications that are already deployed in production

They may produce false positives, reporting issues that are not actual vulnerabilities

A penetration tester is assessing a web application that uses both a REST API and a traditional HTML form-based interface. The tester wants to automate the discovery of common web vulnerabilities such as XSS and CSRF across both interfaces. Which tool category is most suitable?

A web application security scanner

A database vulnerability scanner

What is the primary role of fuzzers in black-box security testing?

To analyze network traffic to identify protocol weaknesses

To brute-force authentication credentials

To generate malformed or unexpected inputs to trigger errors or crashes

To scan for known vulnerabilities using signature databases

How does a vulnerability scanner typically identify potential vulnerabilities in a black-box test?

By sending probes and matching responses against a database of known vulnerability signatures

By intercepting all network traffic passively and analyzing it offline

By brute-forcing all possible input combinations to find any error

By analyzing the source code line by line

What is the primary purpose of black-box security test tools in the context of security testing?

To simulate attacks from an external perspective without knowledge of internal implementation

To analyze the internal code structure of an application to find logic flaws

To verify that all security requirements are met by inspecting configuration files

To replace the need for manual security testing entirely

Certified Tester Security Test Engineer

Domain 9Objective 2

Black-Box Security Test Tools CT-STE Practice Questions (Page 3)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 11–15

11foundation · easy
What is a common limitation of black-box security test tools?
Select an answer first
12application · medium
A penetration tester is assessing a web application that uses both a REST API and a traditional HTML form-based interface. The tester wants to automate the discovery of common web vulnerabilities such as XSS and CSRF across both interfaces. Which tool category is most suitable?
Select an answer first
13foundation · easy
What is the primary role of fuzzers in black-box security testing?
Select an answer first
14foundation · easy
How does a vulnerability scanner typically identify potential vulnerabilities in a black-box test?
Select an answer first
15foundation · easy
What is the primary purpose of black-box security test tools in the context of security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.