Why is test data management important when executing security regression tests?

To reduce the number of test cases needed

To ensure that test data is realistic and consistent across test runs

To eliminate the need for environment setup

A security team has a regression suite with 200 test cases. They have identified that 20 test cases cover previously fixed vulnerabilities, 30 cover critical security functions, and 50 cover high-risk areas. The remaining 100 cover low-risk areas. The team has time to run only 100 test cases in the nightly pipeline. What is the best selection strategy?

Run the 50 high-risk area tests and 50 low-risk area tests.

Run a random selection of 100 tests from the entire suite.

Run all 20 previously fixed vulnerability tests, all 30 critical function tests, and 50 of the high-risk area tests.

Run all 100 low-risk area tests because they are less likely to fail.

In an Agile development environment, a security defect was fixed in a user story. The team is preparing for the sprint review. What is the appropriate security testing activity to perform before the sprint review?

Perform confirmation testing on the fixed defect and run a subset of regression tests related to the changed code.

Defer all security testing until the end of the project.

Run the full security regression suite to ensure no other stories were affected.

Only perform confirmation testing and skip regression testing.

A security tester is executing a regression suite that includes a test for a file upload vulnerability. The test environment has a shared database with other testers, and the test data is not isolated. What is the most likely impact on the regression test results?

The test will fail because the shared database is not secure.

The test results will be more realistic because of the shared data.

The test results will be unaffected because the test is isolated.

The test results may be unreliable due to interference from other testers' data.

A security team is considering automating their security regression tests. They have a mix of tests that require complex setup and some that are simple. What is a key challenge they should anticipate?

Automated tests always produce false positives.

Automated tests require significant maintenance and may become brittle.

Automated tests cannot be integrated into CI/CD pipelines.

Automated tests are only useful for simple vulnerabilities.

Certified Tester Security Test Engineer

Domain 6Objective 4

Security Regression Testing and Confirmation Testing CT-STE Practice Questions (Page 5)

Part of the Adjusting to Software Development Lifecycle Models domain, which makes up ~9% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

8 Concepts in This Objective

Security Regression Testing Definition
Security Confirmation Testing Definition
Distinguishing Regression and Confirmation Testing
Selecting Security Regression Test Cases
Automating Security Regression Tests
Executing Security Regression and Confirmation Tests
Analyzing and Reporting Results
Integrating with Development Lifecycle

Questions 21–25

21foundation · easy
Why is test data management important when executing security regression tests?
Select an answer first
22expert · hard
A security team has a regression suite with 200 test cases. They have identified that 20 test cases cover previously fixed vulnerabilities, 30 cover critical security functions, and 50 cover high-risk areas. The remaining 100 cover low-risk areas. The team has time to run only 100 test cases in the nightly pipeline. What is the best selection strategy?
Select an answer first
23application · medium
In an Agile development environment, a security defect was fixed in a user story. The team is preparing for the sprint review. What is the appropriate security testing activity to perform before the sprint review?
Select an answer first
24expert · hard
A security tester is executing a regression suite that includes a test for a file upload vulnerability. The test environment has a shared database with other testers, and the test data is not isolated. What is the most likely impact on the regression test results?
Select an answer first
25application · medium
A security team is considering automating their security regression tests. They have a mix of tests that require complex setup and some that are simple. What is a key challenge they should anticipate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.