A security test engineer is designing tests for a new integration between a web application and a third-party analytics service. The integration sends user behavior data to the service. Which security test design technique is most appropriate to identify potential misuse of the integration?

Penetration testing the web application

Code review of the analytics service

Fuzzing the analytics service API

A team is integrating a new payment gateway into an existing e-commerce platform. The integration uses a REST API over HTTPS. During integration-level threat modeling, which threat should be prioritized as most likely to arise from the interaction between the platform and the payment gateway?

Insecure direct object references in the API responses

Man-in-the-middle attack on the HTTPS connection

Improper handling of error responses from the payment gateway

Injection of malicious data through the API request parameters

Which behavior should be validated when testing component interaction security?

That a component correctly rejects malformed input from another component

That components communicate using the fastest possible protocol

That components use the same programming language

That components display error messages to the user

Which element is a key aspect of interface security analysis?

The trust boundary between the components

The database schema used by the system

The programming language used to implement each component

The color scheme of the user interface

A security test engineer is analyzing the interface between a web application and a legacy mainframe system. The mainframe uses a custom protocol over TCP, and the web application translates HTTP requests into this protocol. The team has limited time for testing. Which security test should be prioritized?

Test the authorization controls in the web application

Test the authentication between the web application and the mainframe

Test the error handling of the translation logic

Fuzz the custom protocol with malformed data

Certified Tester Security Test Engineer

Domain 3Objective 4

Security Test Design at Component Integration Level CT-STE Practice Questions (Page 5)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

8 Concepts in This Objective

Security Test Design at Component Integration Level
Integration-Level Threat Modeling
Interface Security Analysis
Security Test Case Derivation for Integration
Component Interaction Security Testing
Integration-Level Security Test Techniques
Prioritization of Integration Security Tests
Traceability of Integration Security Tests

Questions 21–25

21application · medium
A security test engineer is designing tests for a new integration between a web application and a third-party analytics service. The integration sends user behavior data to the service. Which security test design technique is most appropriate to identify potential misuse of the integration?
Select an answer first
22application · medium
A team is integrating a new payment gateway into an existing e-commerce platform. The integration uses a REST API over HTTPS. During integration-level threat modeling, which threat should be prioritized as most likely to arise from the interaction between the platform and the payment gateway?
Select an answer first
23foundation · easy
Which behavior should be validated when testing component interaction security?
Select an answer first
24foundation · easy
Which element is a key aspect of interface security analysis?
Select an answer first
25expert · hard
A security test engineer is analyzing the interface between a web application and a legacy mainframe system. The mainframe uses a custom protocol over TCP, and the web application translates HTTP requests into this protocol. The team has limited time for testing. Which security test should be prioritized?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.