A grey-box fuzzing campaign on a network service produced hundreds of unique crashes. The tester has source code and can rebuild the service with sanitizers. What is the most effective next step to prioritize which crashes to fix first?

Discard crashes that do not reproduce in a debug build

Count the total number of crashes per input and fix the ones with the highest frequency

Submit all crashes to the development team without analysis for manual review

Re-run the crashing inputs under AddressSanitizer and triage by the first stack frame in the application's own code

A small team needs to test a mobile application's backend API. They have the API's source code and want to find vulnerabilities like SQL injection and broken authentication. They have a limited budget and need results quickly. Which tool selection is most appropriate?

Use only a network vulnerability scanner to check the API server's configuration

Purchase an expensive commercial DAST tool that can scan the API

Use an open-source SAST tool to scan the API source code and an open-source API fuzzer for dynamic testing

Hire an external penetration testing firm to manually test the API

A tester needs to assess a desktop application that uses a proprietary binary protocol for communication. They have the application's source code and want to find memory corruption vulnerabilities. Which tool category is most suitable for this task?

A protocol-aware fuzzer that can be customized with the protocol's structure

A network mapper to identify open ports on the host

A web application scanner that tests for HTTP-based vulnerabilities

A static analyzer that only checks for SQL injection patterns

A grey-box fuzzer found a crash in a C application. The crash reproduces consistently, but the stack trace points to a library function (e.g., memcpy) with no application frames. The tester has source code and can rebuild with debug symbols. What is the most appropriate action to determine the root cause?

Use a debugger to step through the library's assembly code line by line

Rebuild the application with AddressSanitizer and re-run the crashing input to get a detailed report with the application's calling context

Disable compiler optimizations and re-run the fuzzer to see if the crash still occurs

Report the crash as a bug in the third-party library without further investigation

A tester is assessing a REST API. They have the OpenAPI specification and database schema but not the underlying server implementation. They need to test for authentication bypasses and injection flaws. Which testing approach best matches this situation?

Use the OpenAPI spec to generate targeted requests and combine with dynamic analysis of responses

Run a network vulnerability scanner against the API's host

Conduct a full white-box code review of the server implementation

Perform black-box testing by sending random HTTP requests without any specification

Certified Tester Security Test Engineer

Domain 9Objective 3

Grey-Box Security Test Tools CT-STE Practice Questions (Page 2)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 6–10

6application · medium
A grey-box fuzzing campaign on a network service produced hundreds of unique crashes. The tester has source code and can rebuild the service with sanitizers. What is the most effective next step to prioritize which crashes to fix first?
Select an answer first
7application · medium
A small team needs to test a mobile application's backend API. They have the API's source code and want to find vulnerabilities like SQL injection and broken authentication. They have a limited budget and need results quickly. Which tool selection is most appropriate?
Select an answer first
8application · medium
A tester needs to assess a desktop application that uses a proprietary binary protocol for communication. They have the application's source code and want to find memory corruption vulnerabilities. Which tool category is most suitable for this task?
Select an answer first
9expert · hard
A grey-box fuzzer found a crash in a C application. The crash reproduces consistently, but the stack trace points to a library function (e.g., memcpy) with no application frames. The tester has source code and can rebuild with debug symbols. What is the most appropriate action to determine the root cause?
Select an answer first
10application · medium
A tester is assessing a REST API. They have the OpenAPI specification and database schema but not the underlying server implementation. They need to test for authentication bypasses and injection flaws. Which testing approach best matches this situation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.