A security team is using a dynamic scanner that is known to have a high rate of false positives. The team is integrating the scanner into their CI/CD pipeline. They want to avoid blocking builds on false positives while still catching real vulnerabilities. Which approach is most effective?

Only run the scanner on the main branch after code is merged

Disable the scanner in the pipeline and run it manually once a month

Fail the build on any finding to ensure no vulnerability is missed

Configure the scanner to report findings but not fail the build, and require manual review of critical findings

A security team plans to run a dynamic scan against a production web application during peak business hours. What is the primary risk they should mitigate?

The scan will not be able to authenticate to the application

The scan may cause performance degradation or service disruption for users

The scan will produce false positives that require manual review

The scan will be blocked by the web application firewall

A security tester is performing a penetration test on a web application. The tester has identified a potential business logic flaw that allows a user to change the price of an item in their shopping cart. The tester wants to confirm the flaw and assess its impact. Which technique is most appropriate?

Use a fuzzer to send random price values

Run an automated vulnerability scanner to detect the flaw

Manually manipulate the request using an intercepting proxy and observe the application's response

Review the source code to confirm the flaw

A security team needs to test a public-facing web application that uses a JavaScript-heavy single-page front end and a REST API backend. The goal is to identify injection flaws and broken authentication. The team has a limited budget and needs results within a week. Which tool category should they prioritize?

A web vulnerability scanner that can crawl the SPA and test the API endpoints

An intercepting proxy used manually by a single tester to explore the application

A fuzzer that sends malformed inputs to the API endpoints

A network vulnerability scanner that checks the underlying infrastructure for known CVEs

When selecting a dynamic security test tool for a mobile application, which factor is most important to consider?

The tool's support for the mobile platform (e.g., iOS, Android) and its ability to interact with the app's runtime environment

The tool's ability to analyze source code for vulnerabilities

The tool's ability to generate detailed reports for compliance audits

The tool's cost and licensing model

Certified Tester Security Test Engineer

Domain 9Objective 5

Dynamic Security Test Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 1–5

1expert · hard
A security team is using a dynamic scanner that is known to have a high rate of false positives. The team is integrating the scanner into their CI/CD pipeline. They want to avoid blocking builds on false positives while still catching real vulnerabilities. Which approach is most effective?
Select an answer first
2application · medium
A security team plans to run a dynamic scan against a production web application during peak business hours. What is the primary risk they should mitigate?
Select an answer first
3expert · hard
A security tester is performing a penetration test on a web application. The tester has identified a potential business logic flaw that allows a user to change the price of an item in their shopping cart. The tester wants to confirm the flaw and assess its impact. Which technique is most appropriate?
Select an answer first
4application · medium
A security team needs to test a public-facing web application that uses a JavaScript-heavy single-page front end and a REST API backend. The goal is to identify injection flaws and broken authentication. The team has a limited budget and needs results within a week. Which tool category should they prioritize?
Select an answer first
5foundation · easy
When selecting a dynamic security test tool for a mobile application, which factor is most important to consider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

Dynamic Security Test Tools CT-STE Practice Questions (Page 1)

Questions 1–5

A security team is using a dynamic scanner that is known to have a high rate of false positives. The team is integrating the scanner into their CI/CD pipeline. They want to avoid blocking builds on false positives while still catching real vulnerabilities. Which approach is most effective?

A security team plans to run a dynamic scan against a production web application during peak business hours. What is the primary risk they should mitigate?

When selecting a dynamic security test tool for a mobile application, which factor is most important to consider?

Keep studying — Security Test Tools