Which of the following is a key factor in assessing the impact of a vulnerability?

The name of the developer who wrote the vulnerable code

The potential for unauthorized access to sensitive data or systems

The number of lines of code in the affected module

The color scheme of the application's user interface

A tester identifies a cross-site scripting (XSS) vulnerability in a web application. The developer team is unfamiliar with XSS and asks for guidance. What is the most actionable remediation advice the tester can provide?

Recommend installing a network firewall to block XSS attacks.

Advise the developers to encode all user-supplied data before rendering it in the browser, and to use a Content Security Policy (CSP).

Suggest the developers use a more secure programming language.

Tell the developers to disable JavaScript in the application entirely.

A security analyst needs to document a vulnerability for a ticket in the organization's issue tracker. The ticket will be viewed by both IT operations staff and the security team. What is the most important information to include in the ticket?

A clear description of the vulnerability, its severity, affected systems, and step-by-step remediation instructions.

Only the vulnerability's name and CVSS score, to keep the ticket brief.

The name of the tester who found the vulnerability and the date it was discovered.

The full exploit code and a detailed walkthrough of how to reproduce the attack.

Which of the following is an example of a clear and actionable remediation recommendation?

Consider using a different programming language

The application should be made more secure

Update the library to version 2.1.4, which includes a fix for the identified vulnerability

The developer should be more careful in the future

What is the purpose of providing mitigation guidance in a vulnerability report?

To provide a legal defense for the organization in case of a data breach

To allow the tester to charge extra for the fix

To explain why the vulnerability is not actually a security issue

To give the organization a temporary or permanent way to reduce the risk until a full fix is applied

Certified Tester Security Test Engineer

Domain 8Objective 3

Hide Vulnerability CT-STE Practice Questions (Page 3)

Part of the Reporting Test Results domain, which makes up ~8% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

Questions 11–15

11foundation · easy
Which of the following is a key factor in assessing the impact of a vulnerability?
Select an answer first
12application · medium
A tester identifies a cross-site scripting (XSS) vulnerability in a web application. The developer team is unfamiliar with XSS and asks for guidance. What is the most actionable remediation advice the tester can provide?
Select an answer first
13application · easy
A security analyst needs to document a vulnerability for a ticket in the organization's issue tracker. The ticket will be viewed by both IT operations staff and the security team. What is the most important information to include in the ticket?
Select an answer first
14foundation · easy
Which of the following is an example of a clear and actionable remediation recommendation?
Select an answer first
15foundation · easy
What is the purpose of providing mitigation guidance in a vulnerability report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.