A development team wants to identify known vulnerabilities in the third-party libraries their application uses. Which type of tool is most appropriate for this task?

Software Composition Analysis (SCA) tool

Which of the following best describes the difference between a SAST tool and a linter?

SAST tools analyze compiled binaries, while linters analyze source code

SAST tools are used only in CI/CD, while linters are used only in IDEs

SAST tools are manual, while linters are automated

SAST tools focus on security vulnerabilities, while linters focus on code style and potential bugs

A team is building a web application in JavaScript and wants to catch common security issues such as cross-site scripting (XSS) and insecure use of eval(). They also want to enforce consistent code style. Which tool category is best suited for this task?

A linter with security-focused rules

A software composition analysis tool

A security team wants to integrate a SAST tool into their developer workflow. They want to provide feedback to developers as early as possible, ideally before the code is committed. What is the best way to achieve this?

Integrate the SAST tool into the IDE as a plugin.

Run the SAST tool only in the CI pipeline after the code is committed.

Run the SAST tool on a nightly basis.

Run the SAST tool manually before each release.

How might an attacker attempt to evade detection by a static analysis tool?

By adding more comments to the code

By running the tool with default settings

By obfuscating the code to hide malicious patterns

By using a different programming language

Certified Tester Security Test Engineer

Domain 9Objective 4

Static Security Test Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 1–5

1foundation · easy
A development team wants to identify known vulnerabilities in the third-party libraries their application uses. Which type of tool is most appropriate for this task?
Select an answer first
2foundation · easy
Which of the following best describes the difference between a SAST tool and a linter?
Select an answer first
3application · medium
A team is building a web application in JavaScript and wants to catch common security issues such as cross-site scripting (XSS) and insecure use of eval(). They also want to enforce consistent code style. Which tool category is best suited for this task?
Select an answer first
4application · medium
A security team wants to integrate a SAST tool into their developer workflow. They want to provide feedback to developers as early as possible, ideally before the code is committed. What is the best way to achieve this?
Select an answer first
5foundation · easy
How might an attacker attempt to evade detection by a static analysis tool?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.