Which of the following is a key activity during security test execution?

Recording the results of each executed security test case

Defining the scope of security testing

What is a key activity in security test closure?

Executing the remaining security test cases

Summarizing the outcomes of the security testing effort

Identifying security requirements

During security test execution, a tester triggers an input that causes the application to crash with an unhandled exception. The tester notices that the error message reveals stack trace details. What should the tester do immediately?

Immediately restart the application and rerun the same test to confirm the crash

Report the crash to the development team and stop all testing

Record the crash details and continue with the next test case

Ignore the crash because it is a functional issue, not a security issue

During a security test, a tester discovers that an application is vulnerable to a critical remote code execution flaw. The tester also notices that the vulnerability is being actively exploited in the wild. What should the tester do first?

Immediately notify the incident response team and the system owner

Continue testing to gather more evidence before reporting

Attempt to exploit the vulnerability further to understand its full impact

Document the finding and include it in the final report

A security test team is designing tests for a critical infrastructure system that cannot be taken offline. The system uses a legacy protocol that is known to have vulnerabilities. The team must test the system without causing disruption. Which approach is most appropriate?

Skip security testing because the system cannot be taken offline

Use passive monitoring and non-intrusive testing techniques to gather information without sending malicious payloads

Perform active penetration testing during off-peak hours

Test the system in a production environment with full attack simulations

Certified Tester Security Test Engineer

Domain 3Objective 1

ISTQB Security Test Process CT-STE Practice Questions (Page 2)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
Which of the following is a key activity during security test execution?
Select an answer first
7foundation · easy
What is a key activity in security test closure?
Select an answer first
8application · medium
During security test execution, a tester triggers an input that causes the application to crash with an unhandled exception. The tester notices that the error message reveals stack trace details. What should the tester do immediately?
Select an answer first
9expert · hard
During a security test, a tester discovers that an application is vulnerable to a critical remote code execution flaw. The tester also notices that the vulnerability is being actively exploited in the wild. What should the tester do first?
Select an answer first
10expert · hard
A security test team is designing tests for a critical infrastructure system that cannot be taken offline. The system uses a legacy protocol that is known to have vulnerabilities. The team must test the system without causing disruption. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.