Which scenario best illustrates the need for security regression testing?

A developer fixes a SQL injection vulnerability in a login form, and the tester verifies that the fix works and does not break the login functionality

A new authentication module is added to an existing application, and the tester checks that the new module does not weaken the existing session management controls

A security analyst reviews the source code of a critical component to find potential buffer overflow issues

A tester performs a penetration test on a newly developed application to identify as many vulnerabilities as possible before release

A security team maintains a regression test suite for a web application. They have limited time to run tests before each release. Which set of test cases should be prioritized for the security regression suite?

Test cases covering previously fixed vulnerabilities, critical security functions, and high-risk areas.

All test cases that have ever been written for the application, regardless of relevance.

Only the test cases that failed in the last test run.

Test cases that are easiest to automate, regardless of the security function they cover.

After running a security regression suite, the tester notices that a previously fixed SQL injection vulnerability is now exploitable again. What is the most appropriate action?

Report the regression and work with developers to fix the issue.

Mark the test as a false positive without further investigation.

Ignore it because it was already fixed once.

Remove the test case from the suite to avoid future failures.

Which criterion is most important when selecting security regression test cases?

Test cases that were written by the most experienced tester on the team

Test cases that are quickest to execute, to maximize the number of tests run

Test cases that are easiest to automate, to reduce manual effort

Test cases that cover previously fixed vulnerabilities and critical security functions

What is the purpose of reporting security regression and confirmation test results to stakeholders?

To fulfill regulatory requirements only

To provide evidence that the software is completely secure

To assign blame to developers for introducing vulnerabilities

To inform stakeholders about the effectiveness of fixes and any remaining risks

Certified Tester Security Test Engineer

Domain 6Objective 4

Security Regression Testing and Confirmation Testing CT-STE Practice Questions (Page 6)

Part of the Adjusting to Software Development Lifecycle Models domain, which makes up ~9% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

8 Concepts in This Objective

Security Regression Testing Definition
Security Confirmation Testing Definition
Distinguishing Regression and Confirmation Testing
Selecting Security Regression Test Cases
Automating Security Regression Tests
Executing Security Regression and Confirmation Tests
Analyzing and Reporting Results
Integrating with Development Lifecycle

Questions 26–30

26foundation · easy
Which scenario best illustrates the need for security regression testing?
Select an answer first
27application · medium
A security team maintains a regression test suite for a web application. They have limited time to run tests before each release. Which set of test cases should be prioritized for the security regression suite?
Select an answer first
28application · medium
After running a security regression suite, the tester notices that a previously fixed SQL injection vulnerability is now exploitable again. What is the most appropriate action?
Select an answer first
29foundation · easy
Which criterion is most important when selecting security regression test cases?
Select an answer first
30foundation · easy
What is the purpose of reporting security regression and confirmation test results to stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.