A company is integrating a customer-facing web portal with an internal CRM system. The integration exposes customer data. The team has limited time for security testing. Which integration security test should be prioritized?

Testing the authentication mechanism between the portal and the CRM

Testing the availability of the CRM system

Testing the performance of the integration under load

Testing the authorization controls to ensure users can only access their own data

A company is integrating a new customer relationship management (CRM) system with an existing email system. The integration will allow the CRM to send emails on behalf of users. The team has identified two threats: (1) unauthorized sending of emails via the integration, and (2) email spoofing. The company has limited security testing budget. Which threat should be prioritized?

Both threats equally, because both are critical

Unauthorized sending, because it is more likely to occur

Unauthorized sending, because it could damage the company's reputation

Email spoofing, because it could be used to trick users into revealing credentials

What is a primary source for deriving integration-level security test cases?

The integration-level threat model

The marketing requirements document

Which objective is specific to security testing at the component integration level?

Identifying vulnerabilities in the interaction logic between components

Verifying that each component meets its individual security requirements

Confirming that the system meets user acceptance criteria

Ensuring that the system is free of all security vulnerabilities

Which technique is commonly used to test the security of component interfaces by sending unexpected or malformed data?

Penetration testing of the entire system

Certified Tester Security Test Engineer

Domain 3Objective 4

Security Test Design at Component Integration Level CT-STE Practice Questions (Page 1)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

8 Concepts in This Objective

Security Test Design at Component Integration Level
Integration-Level Threat Modeling
Interface Security Analysis
Security Test Case Derivation for Integration
Component Interaction Security Testing
Integration-Level Security Test Techniques
Prioritization of Integration Security Tests
Traceability of Integration Security Tests

Questions 1–5

1application · medium
A company is integrating a customer-facing web portal with an internal CRM system. The integration exposes customer data. The team has limited time for security testing. Which integration security test should be prioritized?
Select an answer first
2expert · hard
A company is integrating a new customer relationship management (CRM) system with an existing email system. The integration will allow the CRM to send emails on behalf of users. The team has identified two threats: (1) unauthorized sending of emails via the integration, and (2) email spoofing. The company has limited security testing budget. Which threat should be prioritized?
Select an answer first
3foundation · easy
What is a primary source for deriving integration-level security test cases?
Select an answer first
4foundation · easy
Which objective is specific to security testing at the component integration level?
Select an answer first
5foundation · easy
Which technique is commonly used to test the security of component interfaces by sending unexpected or malformed data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.