What does total cost of ownership (TCO) include when evaluating a security test tool?

The cost of the tool's user interface design

The cost of the vendor's marketing materials

Only the initial purchase price of the tool

License fees, training, maintenance, and hardware or infrastructure costs

What is the primary purpose of integrating a security test tool with a CI/CD pipeline?

To reduce the cost of the tool license

To run security tests automatically as part of the build and deployment process

To replace the need for manual security testing entirely

To ensure the tool is compatible with all operating systems

Which of the following is an indicator of a well-maintained open-source security test tool?

A paid support contract with the original author

Regular releases and an active community of contributors

A single developer who updates the code occasionally

A company is evaluating two SAST tools. Tool A has excellent detection capabilities but requires significant manual effort to configure and tune. Tool B has slightly lower detection capabilities but is much easier to use and integrates seamlessly with the developer IDE. The development team is large and has varying levels of security expertise. What is the most important factor in this decision?

The superior detection capabilities of Tool A, as finding more vulnerabilities is the primary goal.

The ease of use and integration of Tool B, as it is more likely to be adopted by the large development team.

The tool's ability to generate reports for compliance audits.

The cost of each tool, as the budget is the primary constraint.

Which of the following is an example of a tool integration consideration?

The tool's license is perpetual rather than subscription

The tool's user interface is easy to navigate

The tool can export results in a format that the defect tracking system can import

Certified Tester Security Test Engineer

Domain 9Objective 6

Considerations for Selecting Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

Questions 1–5

1foundation · easy
What does total cost of ownership (TCO) include when evaluating a security test tool?
Select an answer first
2foundation · easy
What is the primary purpose of integrating a security test tool with a CI/CD pipeline?
Select an answer first
3foundation · easy
Which of the following is an indicator of a well-maintained open-source security test tool?
Select an answer first
4expert · hard
A company is evaluating two SAST tools. Tool A has excellent detection capabilities but requires significant manual effort to configure and tune. Tool B has slightly lower detection capabilities but is much easier to use and integrates seamlessly with the developer IDE. The development team is large and has varying levels of security expertise. What is the most important factor in this decision?
Select an answer first
5foundation · easy
Which of the following is an example of a tool integration consideration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.