Which of the following is a common technique used to gain unauthorized access to a system?

Exploiting a buffer overflow vulnerability

A security team is reviewing their external attack surface. They want to identify what information an attacker could gather without sending a single packet to their network. Which of the following techniques would be most relevant?

Running a vulnerability scanner against the company's firewall

Port scanning the company's public IP range

Searching public records and social media for employee information

Banner grabbing from the company's web server

A penetration tester has identified a critical vulnerability in a web application that allows remote code execution. However, the tester notices that the application is monitored by a security information and event management (SIEM) system that alerts on unusual outbound connections. The tester needs to gain access without triggering an alert. Which approach best balances the need to exploit the vulnerability and avoid detection?

Exploit the vulnerability immediately and rely on the SIEM's inability to detect the specific payload

First, identify the SIEM's detection rules and then craft the exploit to avoid those specific signatures

Use a multi-stage payload that establishes an encrypted outbound connection to a non-standard port

Delay the exploitation until the SIEM is offline for maintenance

What is the primary goal of a hacker when exploiting a vulnerability?

To verify the system's compliance with security standards

To increase the system's processing speed

To gain unauthorized access or control over the target system

To document the vulnerability for a public advisory

Certified Tester Security Test Engineer

Domain 5Objective 4

Common Approach of a Hacker CT-STE Practice Questions (Page 2)

Part of the Adjusting To the Organizational Context domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

Questions 6–10

6foundation · easy
Which of the following is a common technique used to gain unauthorized access to a system?
Select an answer first
7application · medium
A security team is reviewing their external attack surface. They want to identify what information an attacker could gather without sending a single packet to their network. Which of the following techniques would be most relevant?
Select an answer first
8expert · hard
A penetration tester has identified a critical vulnerability in a web application that allows remote code execution. However, the tester notices that the application is monitored by a security information and event management (SIEM) system that alerts on unusual outbound connections. The tester needs to gain access without triggering an alert. Which approach best balances the need to exploit the vulnerability and avoid detection?
Select an answer first
9foundation · easy
What is the primary goal of a hacker when exploiting a vulnerability?
Select an answer first
10foundation · easy
Which technique is used to discover open ports and services on a target system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

Common Approach of a Hacker CT-STE Practice Questions (Page 2)

Questions 6–10

Which of the following is a common technique used to gain unauthorized access to a system?

A security team is reviewing their external attack surface. They want to identify what information an attacker could gather without sending a single packet to their network. Which of the following techniques would be most relevant?

What is the primary goal of a hacker when exploiting a vulnerability?

Which technique is used to discover open ports and services on a target system?

Keep studying — Adjusting To the Organizational Context