A tester is new to a project and has been given the database schema and API documentation for a web application, but not the source code. They are asked to perform a security assessment focusing on business logic flaws. Which approach is most aligned with grey-box testing principles?

Use the schema and API docs to understand data flows and craft test cases that manipulate state transitions and access controls

Perform a black-box test by only using the application's user interface

Request the source code and perform a full white-box review

Run an automated vulnerability scanner and report all findings without manual analysis

A tester is assessing a web application and has been given the source code of the authentication module but not the rest of the application. They want to test for authorization flaws. Which approach best leverages this partial knowledge?

Perform a black-box test by only using the application's UI without any code analysis

Run a network vulnerability scanner to find open ports

Analyze the authentication source code to understand session management and then dynamically test authorization on all endpoints

Request the full source code and perform a complete white-box review

A tester is assessing a web application and has the source code. They want to find both client-side and server-side vulnerabilities. Which combination of grey-box tool categories is most effective?

Only a static analyzer for the client-side JavaScript

A static analyzer for the server-side code and a dynamic analyzer (browser-based) for client-side behavior

Only a fuzzer for the server-side API

Only a network vulnerability scanner

A team needs to test a Node.js application that uses a NoSQL database. They have the source code and want to find injection flaws and insecure deserialization. Which tool selection is most appropriate?

Use a SQL injection scanner designed for relational databases

Use only a network vulnerability scanner to check the Node.js server

Use a SAST tool that supports JavaScript and a dynamic API fuzzer that can send NoSQL injection payloads

Perform only a manual code review without any automated tools

Certified Tester Security Test Engineer

Domain 9Objective 3

Grey-Box Security Test Tools CT-STE Practice Questions (Page 6)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 26–29

26application · medium
A tester is new to a project and has been given the database schema and API documentation for a web application, but not the source code. They are asked to perform a security assessment focusing on business logic flaws. Which approach is most aligned with grey-box testing principles?
Select an answer first
27application · medium
A tester is assessing a web application and has been given the source code of the authentication module but not the rest of the application. They want to test for authorization flaws. Which approach best leverages this partial knowledge?
Select an answer first
28application · medium
A tester is assessing a web application and has the source code. They want to find both client-side and server-side vulnerabilities. Which combination of grey-box tool categories is most effective?
Select an answer first
29application · medium
A team needs to test a Node.js application that uses a NoSQL database. They have the source code and want to find injection flaws and insecure deserialization. Which tool selection is most appropriate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.