A developer has written a C++ component that parses network packets. The team wants to test the component in isolation for memory corruption vulnerabilities before integration. Which approach is most appropriate for this component-level security test?

Review the component's source code manually for common coding mistakes, without executing the code.

Use a network scanner to identify open ports and services on the component's host.

Perform a full end-to-end penetration test against the deployed application to identify real-world exploit paths.

Run a fuzzing tool that feeds malformed packet data to the component's public API and monitors for crashes or memory errors.

What is the main focus of security test objectives at the component test level?

Ensuring the component's security functions work correctly in isolation

Ensuring the component meets all business requirements

Ensuring the component is user-friendly and accessible

Ensuring the component integrates securely with other components

What does traceability in component security testing ensure?

That each security requirement and risk is linked to corresponding test cases

That the test environment is identical to the production environment

That all test cases are executed in the same order

That the test team has access to the source code

A tester discovers a security defect in a component but is unsure whether it is exploitable in the full system. What is the most appropriate way to document this in the security test report?

Do not report it because it may not be exploitable.

Report it as a critical vulnerability because it could be exploited.

Report it as a low-priority issue because it is only at component level.

Report the defect with a clear description of the component-level impact and note that exploitability at system level is unverified.

A team is testing a component that provides authorization decisions based on user roles. Which security test objective is most relevant for this component?

Ensure the component returns responses within a specified time.

Verify that the component denies access to resources for unauthorized roles.

Check that the component logs all successful logins.

Confirm that the component's user interface is accessible.

Certified Tester Security Test Engineer

Domain 3Objective 3

Security Test Design at Component Test Level CT-STE Practice Questions (Page 5)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

8 Concepts in This Objective

Security Test Design at Component Level
Component-Level Security Test Objectives
Threat and Risk Analysis for Components
Security Test Design Techniques for Components
Security Test Cases for Components
Component Security Test Environment and Tools
Coverage and Traceability in Component Security Testing
Documentation and Reporting of Component Security Tests

Questions 21–25

21application · medium
A developer has written a C++ component that parses network packets. The team wants to test the component in isolation for memory corruption vulnerabilities before integration. Which approach is most appropriate for this component-level security test?
Select an answer first
22foundation · easy
What is the main focus of security test objectives at the component test level?
Select an answer first
23foundation · easy
What does traceability in component security testing ensure?
Select an answer first
24expert · hard
A tester discovers a security defect in a component but is unsure whether it is exploitable in the full system. What is the most appropriate way to document this in the security test report?
Select an answer first
25application · medium
A team is testing a component that provides authorization decisions based on user roles. Which security test objective is most relevant for this component?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.