A dynamic scan report includes a finding for a 'medium' severity information disclosure vulnerability. The affected endpoint exposes internal error messages. The development team says the endpoint is only accessible to authenticated users. What should the security tester do?

Ignore the finding because it is only medium severity

Verify whether the endpoint is truly restricted to authenticated users and whether the error messages reveal sensitive information

Immediately request a hotfix to remove the error messages

Report the finding as a critical issue to management

A QA team is testing a file upload feature in a web application. They want to discover unexpected behavior when files with unusual formats, sizes, or content are submitted. Which dynamic testing technique is most appropriate?

Fuzzing the upload endpoint with malformed and unexpected file inputs

Performing a manual code review of the upload handling logic

Using an intercepting proxy to modify the file upload request in transit

Running a vulnerability scanner to check for known CVEs in the upload module

A security tester needs to assess a web application's resistance to SQL injection attacks. Which type of tool is most appropriate for this objective?

A fuzzer that sends random data to all input fields

A vulnerability scanner that includes checks for SQL injection

A source code editor with security plugins

A security analyst runs a dynamic scan and receives a report with 50 findings. The analyst needs to prioritize remediation efforts. Which approach is most effective?

Delegate all findings to the development team for independent prioritization

Prioritize findings based on the CVSS score and the business impact of the affected asset

Fix all findings in the order they appear in the report

Focus only on findings that have a proof-of-concept exploit available

Certified Tester Security Test Engineer

Domain 9Objective 5

Dynamic Security Test Tools CT-STE Practice Questions (Page 3)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 11–15

11application · medium
A dynamic scan report includes a finding for a 'medium' severity information disclosure vulnerability. The affected endpoint exposes internal error messages. The development team says the endpoint is only accessible to authenticated users. What should the security tester do?
Select an answer first
12application · medium
A QA team is testing a file upload feature in a web application. They want to discover unexpected behavior when files with unusual formats, sizes, or content are submitted. Which dynamic testing technique is most appropriate?
Select an answer first
13foundation · easy
A security tester needs to assess a web application's resistance to SQL injection attacks. Which type of tool is most appropriate for this objective?
Select an answer first
14application · medium
A security analyst runs a dynamic scan and receives a report with 50 findings. The analyst needs to prioritize remediation efforts. Which approach is most effective?
Select an answer first
15foundation · easy
Which tool category is specifically designed to automatically scan web applications for known vulnerabilities such as SQL injection and cross-site scripting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.