How is security test coverage measured at the component level?

By checking that all code lines are executed

By counting the total number of test cases executed

By determining the percentage of security requirements and risks that are addressed by test cases

By measuring the time taken to execute all tests

A team is designing security tests for a component that handles user-supplied XML data. Threat modeling identified a risk of XML External Entity (XXE) injection. Which test case would most directly validate the component's resistance to this threat?

Send a very large XML file to test the component's memory usage.

Verify that the component can parse XML files from multiple sources.

Check that the component's XML parser is well-documented.

Submit an XML document containing an external entity that references a local file, and verify the component does not disclose its contents.

A security test lead wants to measure how thoroughly the component's security requirements have been tested. Which metric is most appropriate?

Percentage of security requirements with at least one executed test case.

Number of defects found during testing.

Time spent on security testing.

A team is testing a component that provides authentication. They have test cases for valid and invalid credentials, but they have not tested for brute-force resistance. The component is expected to handle high-volume login requests. Which additional test case is most important to add?

Verify that the component logs successful logins.

Test that the component accepts passwords with special characters.

Test the component's response time under normal load.

Simulate a rapid sequence of failed login attempts and verify that the component enforces a lockout or rate limit.

What is the role of risk analysis in component-level security testing?

To replace the need for security testing altogether

To prioritize which security tests to perform based on the likelihood and impact of potential vulnerabilities

To determine the exact number of test cases needed for full coverage

To ensure the component is free of all possible defects

Certified Tester Security Test Engineer

Domain 3Objective 3

Security Test Design at Component Test Level CT-STE Practice Questions (Page 6)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

8 Concepts in This Objective

Security Test Design at Component Level
Component-Level Security Test Objectives
Threat and Risk Analysis for Components
Security Test Design Techniques for Components
Security Test Cases for Components
Component Security Test Environment and Tools
Coverage and Traceability in Component Security Testing
Documentation and Reporting of Component Security Tests

Questions 26–30

26foundation · easy
How is security test coverage measured at the component level?
Select an answer first
27application · medium
A team is designing security tests for a component that handles user-supplied XML data. Threat modeling identified a risk of XML External Entity (XXE) injection. Which test case would most directly validate the component's resistance to this threat?
Select an answer first
28application · medium
A security test lead wants to measure how thoroughly the component's security requirements have been tested. Which metric is most appropriate?
Select an answer first
29expert · hard
A team is testing a component that provides authentication. They have test cases for valid and invalid credentials, but they have not tested for brute-force resistance. The component is expected to handle high-volume login requests. Which additional test case is most important to add?
Select an answer first
30foundation · easy
What is the role of risk analysis in component-level security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.