Two systems exchange data using a proprietary binary protocol over a TCP connection. The protocol has no built-in authentication or integrity checks. What is the most important security test to design for this interface?

Test that the sending system authenticates the receiving system

Test that the connection is encrypted using TLS

Test that the protocol handles malformed data gracefully

Test that the receiving system validates the integrity of the data

A security test engineer is performing threat modeling for a new integration between a mobile app and a backend server. The mobile app uses a third-party SDK for analytics. The threat model identifies that the SDK could be compromised and send malicious data to the backend. What is the most effective mitigation to test?

Use certificate pinning for the SDK's API calls

Validate all data received from the SDK on the backend

Disable the SDK if it is not essential

Encrypt the communication between the SDK and the backend

Two components in a system communicate via a message queue. The sending component is known to occasionally send malformed messages due to a bug. The receiving component crashes when it receives a malformed message. What is the most appropriate security test to design for this interaction?

Test that the receiving component handles malformed messages gracefully

Test that the sending component is fixed to not send malformed messages

Test that the message queue rejects malformed messages

Test that the system restarts after a crash

A team is integrating a new authentication service with an existing application. The integration uses a REST API. The team wants to test the robustness of the interface against unexpected input. Which security test design technique is most appropriate for this scenario?

Conducting a penetration test on the entire application

Performing a code review of the authentication service

Fuzzing the API with malformed data

Running a vulnerability scanner against the API

A team is integrating a new reporting module into an existing application. The module will access sensitive financial data. The team needs to define the scope of security testing for this integration. What is the most important factor to consider when defining the scope?

The sensitivity of the data accessed by the module

The user interface design of the module

The number of new features added by the reporting module

The programming language used to develop the module

Certified Tester Security Test Engineer

Domain 3Objective 4

Security Test Design at Component Integration Level CT-STE Practice Questions (Page 2)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

8 Concepts in This Objective

Security Test Design at Component Integration Level
Integration-Level Threat Modeling
Interface Security Analysis
Security Test Case Derivation for Integration
Component Interaction Security Testing
Integration-Level Security Test Techniques
Prioritization of Integration Security Tests
Traceability of Integration Security Tests

Questions 6–10

6application · medium
Two systems exchange data using a proprietary binary protocol over a TCP connection. The protocol has no built-in authentication or integrity checks. What is the most important security test to design for this interface?
Select an answer first
7expert · hard
A security test engineer is performing threat modeling for a new integration between a mobile app and a backend server. The mobile app uses a third-party SDK for analytics. The threat model identifies that the SDK could be compromised and send malicious data to the backend. What is the most effective mitigation to test?
Select an answer first
8expert · hard
Two components in a system communicate via a message queue. The sending component is known to occasionally send malformed messages due to a bug. The receiving component crashes when it receives a malformed message. What is the most appropriate security test to design for this interaction?
Select an answer first
9application · medium
A team is integrating a new authentication service with an existing application. The integration uses a REST API. The team wants to test the robustness of the interface against unexpected input. Which security test design technique is most appropriate for this scenario?
Select an answer first
10application · medium
A team is integrating a new reporting module into an existing application. The module will access sensitive financial data. The team needs to define the scope of security testing for this integration. What is the most important factor to consider when defining the scope?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.