Grey-Box Security Test Tools CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A grey-box fuzzer is configured to test a network protocol parser. The fuzzer is generating many inputs, but the code coverage is not increasing, and no crashes are found. The tester has the source code and can instrument the build. What is the most likely cause of the lack of progress?

   • AThe fuzzer is configured to only test error-handling code paths
   • BThe parser is written in a language that is not supported by the fuzzer
   • CThe fuzzer is generating too many inputs, causing the target to crash before coverage is measured
   • DThe fuzzer lacks a proper seed corpus, so it is not reaching deeper code paths in the parser
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A tester is configuring a grey-box fuzzer for a Python web application. The application uses a SQL database and has an authentication mechanism. The tester has access to the application's routes and templates but not the database credentials. What is the most effective configuration to maximize the fuzzer's ability to find SQL injection vulnerabilities?

   • ASet the fuzzer to use only the application's templates to generate inputs
   • BProvide the fuzzer with valid session tokens and a dictionary of SQL injection payloads to apply to all input parameters
   • CDisable the fuzzer's logging to improve performance and reduce disk usage
   • DConfigure the fuzzer to only test unauthenticated endpoints to avoid rate limiting
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   After running a grey-box static analyzer, the tool reports a potential SQL injection in a search function. What is the next step in interpreting this result?

   • AManually review the code to confirm the vulnerability and assess its exploitability
   • BIgnore the result because static analyzers always produce false positives
   • CDelete the search function to eliminate the vulnerability
   • DImmediately patch the code without further analysis
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In grey-box testing, what is the primary purpose of configuring a tool with partial knowledge such as API endpoints or database schemas?

   • ATo reduce the number of false positives by focusing tests on known high-risk areas
   • BTo allow the tool to automatically fix vulnerabilities it finds
   • CTo ensure the tool only tests the user interface and not backend logic
   • DTo make the tool run faster by skipping authentication checks
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A team must test a large, monolithic Java application that has been in production for years. They have the source code but cannot easily deploy it in a test environment due to complex dependencies. They need to find security vulnerabilities quickly and with minimal setup. Which approach is most practical?

   • ARun a static analysis tool on the source code to identify common vulnerabilities without deploying the application
   • BUse a network vulnerability scanner against the production environment
   • CSet up a full test environment with all dependencies and run a dynamic fuzzer
   • DPerform a manual code review of the entire codebase
   Reveal Solution Discussion Select an answer first