A team is integrating a new file upload service with an existing web application. The service accepts files from users and stores them in a cloud storage bucket. The team wants to test the security of the integration. Which security test design technique is most appropriate to test the file upload service's handling of malicious files?

Penetration testing the entire web application

Fuzzing the file upload endpoint with malformed files

Misuse cases to identify how an attacker could abuse the file upload

Code review of the file upload service

Two microservices communicate via a message queue. The sending service serializes objects using Java serialization. The receiving service deserializes them. As a security test engineer, what is the most important interface security concern to address in your test design?

The queue may be accessible to unauthorized services

The message size may exceed the queue's limit

The serialized data may contain malicious payloads that exploit deserialization

The queue may not encrypt messages at rest

What is the purpose of traceability between integration-level security test cases and security requirements?

To make the test cases easier to read

To reduce the number of test cases needed

To ensure that all security requirements are covered by at least one test case

To document the test environment setup

What is the main purpose of threat modeling at the component integration level?

To document the functional requirements of each component

To list all possible threats to the entire system in a single diagram

To replace the need for security testing

To identify security threats that arise from the interaction of integrated components

What is the primary focus of interface security analysis?

Evaluating the security of the data exchange and trust boundaries between components

Verifying that the interface meets functional specifications

Testing the performance of the interface under high load

Ensuring that the interface is user-friendly

Certified Tester Security Test Engineer

Domain 3Objective 4

Security Test Design at Component Integration Level CT-STE Practice Questions (Page 3)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

8 Concepts in This Objective

Security Test Design at Component Integration Level
Integration-Level Threat Modeling
Interface Security Analysis
Security Test Case Derivation for Integration
Component Interaction Security Testing
Integration-Level Security Test Techniques
Prioritization of Integration Security Tests
Traceability of Integration Security Tests

Questions 11–15

11application · medium
A team is integrating a new file upload service with an existing web application. The service accepts files from users and stores them in a cloud storage bucket. The team wants to test the security of the integration. Which security test design technique is most appropriate to test the file upload service's handling of malicious files?
Select an answer first
12application · medium
Two microservices communicate via a message queue. The sending service serializes objects using Java serialization. The receiving service deserializes them. As a security test engineer, what is the most important interface security concern to address in your test design?
Select an answer first
13foundation · easy
What is the purpose of traceability between integration-level security test cases and security requirements?
Select an answer first
14foundation · easy
What is the main purpose of threat modeling at the component integration level?
Select an answer first
15foundation · easy
What is the primary focus of interface security analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.