A dynamic scan reports a 'high' severity finding for a cross-site scripting (XSS) vulnerability in a web application. The development team argues that the affected input is not user-controllable. What should the security tester do?

Increase the scanner's intensity and re-run the scan

Accept the developer's claim and close the finding

Manually verify the finding by reproducing the XSS with a crafted request

Report the finding as confirmed to management

Which risk is associated with running dynamic security testing tools against a production system?

The tool may inadvertently modify or corrupt production data

The tool will expose the source code to attackers

The tool will always crash the application

The tool will automatically fix any vulnerabilities it finds

A security tester is explaining to a developer why dynamic analysis is necessary in addition to static analysis. Which statement best describes the unique value of dynamic analysis?

It can find all vulnerabilities without requiring access to the source code

It is faster and cheaper than static analysis

It can identify vulnerabilities that only manifest when the application is running and processing real input

It replaces the need for manual penetration testing

A security team must test a web application that is only accessible from within a private network. The team wants to use an external vulnerability scanner that is hosted in the cloud. Which constraint is most likely to affect the testing?

The scanner will not be able to authenticate to the application

The scanner cannot reach the application because it is not publicly accessible

The scanner will produce false positives due to the private network

The scanner will not have the latest vulnerability database

Certified Tester Security Test Engineer

Domain 9Objective 5

Dynamic Security Test Tools CT-STE Practice Questions (Page 5)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

Questions 21–25

21application · medium
A dynamic scan reports a 'high' severity finding for a cross-site scripting (XSS) vulnerability in a web application. The development team argues that the affected input is not user-controllable. What should the security tester do?
Select an answer first
22foundation · easy
Which risk is associated with running dynamic security testing tools against a production system?
Select an answer first
23application · medium
A security tester is explaining to a developer why dynamic analysis is necessary in addition to static analysis. Which statement best describes the unique value of dynamic analysis?
Select an answer first
24expert · hard
A security team must test a web application that is only accessible from within a private network. The team wants to use an external vulnerability scanner that is hosted in the cloud. Which constraint is most likely to affect the testing?
Select an answer first
25foundation · easy
Which tool category allows a tester to intercept and modify HTTP requests and responses between a browser and a web application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.