What is a key feature of dynamic testing tools like Burp Suite?

They can monitor the application's runtime behavior to block attacks in real time.

They can analyze source code for security vulnerabilities without executing the application.

They can intercept and modify HTTP requests to test a web application's security.

They can scan the network for open ports and services.

A development team uses a CI/CD pipeline. The security lead wants to automatically identify potential SQL injection vulnerabilities in the code before it is built and deployed. The team uses a Java application with a PostgreSQL database. Which tool and integration point is most appropriate?

Perform a manual code review of the database access layer only.

Use a fuzzing tool to generate random inputs for the database queries.

Integrate a SAST tool into the CI pipeline to scan the source code before the build step.

Integrate a DAST tool into the CI pipeline to scan the running application after deployment.

A security tester is investigating a potential vulnerability in a web application. The tester has access to the source code and a running test environment. The vulnerability is suspected to be a race condition that only occurs under specific runtime conditions. Which approach is most effective to confirm the vulnerability?

Perform a manual code review of the concurrency logic.

Use static analysis to trace the code paths that could lead to a race condition.

Use a taint analysis tool to trace data flow through the concurrent code.

Use dynamic testing with a fuzzing tool to send concurrent requests to the application.

A security team is implementing a secure coding standard. They want to enforce that all code changes are checked for common vulnerabilities before they are merged into the main branch. The team uses a Git-based workflow and wants to automate this check. Which approach is most effective?

Perform a manual code review only when a developer requests it.

Use a fuzzing tool to test the application's API endpoints after deployment.

Configure a SAST tool to run on every pull request and block the merge if critical issues are found.

Run a DAST tool against the production environment after each merge.

A security team is planning a testing strategy for a new application that will be deployed in a highly regulated environment. The team must demonstrate that security testing is performed at multiple stages of the SDLC. They have a limited budget and need to choose between investing in SAST or DAST tools. Which approach best meets the regulatory requirement while managing costs?

Invest only in a commercial DAST tool and skip static testing.

Invest in a SAST tool for early detection and use a free, open-source DAST tool for runtime testing.

Use only manual code reviews and no automated tools.

Invest only in a commercial SAST tool and skip dynamic testing.

Certified Tester Security Test Engineer

Domain 2Objective 2

Static and Dynamic Security Testing CT-STE Practice Questions (Page 4)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

8concepts

Questions 16–20

16foundation · easy
What is a key feature of dynamic testing tools like Burp Suite?
Select an answer first
17application · medium
A development team uses a CI/CD pipeline. The security lead wants to automatically identify potential SQL injection vulnerabilities in the code before it is built and deployed. The team uses a Java application with a PostgreSQL database. Which tool and integration point is most appropriate?
Select an answer first
18expert · hard
A security tester is investigating a potential vulnerability in a web application. The tester has access to the source code and a running test environment. The vulnerability is suspected to be a race condition that only occurs under specific runtime conditions. Which approach is most effective to confirm the vulnerability?
Select an answer first
19application · medium
A security team is implementing a secure coding standard. They want to enforce that all code changes are checked for common vulnerabilities before they are merged into the main branch. The team uses a Git-based workflow and wants to automate this check. Which approach is most effective?
Select an answer first
20expert · hard
A security team is planning a testing strategy for a new application that will be deployed in a highly regulated environment. The team must demonstrate that security testing is performed at multiple stages of the SDLC. They have a limited budget and need to choose between investing in SAST or DAST tools. Which approach best meets the regulatory requirement while managing costs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

Static and Dynamic Security Testing CT-STE Practice Questions (Page 4)

Questions 16–20

What is a key feature of dynamic testing tools like Burp Suite?

A development team uses a CI/CD pipeline. The security lead wants to automatically identify potential SQL injection vulnerabilities in the code before it is built and deployed. The team uses a Java application with a PostgreSQL database. Which tool and integration point is most appropriate?

A security team is implementing a secure coding standard. They want to enforce that all code changes are checked for common vulnerabilities before they are merged into the main branch. The team uses a Git-based workflow and wants to automate this check. Which approach is most effective?

Keep studying — Security Test Techniques