A security engineer is evaluating the effectiveness of their SAST tool. They notice that the tool does not flag a known vulnerability that exists in the codebase. The vulnerability is in a function that is called indirectly through a function pointer. What is the most likely reason the SAST tool missed this vulnerability?

The tool does not perform interprocedural analysis across indirect calls.

The tool is configured to ignore that specific vulnerability class.

The tool requires a special plugin to analyze function pointers.

The vulnerability is a false negative because the tool only reports true positives.

What is a common way to provide feedback from static analysis tools to developers in a CI/CD workflow?

By posting comments on the code review or merge request

By printing results to the console without saving them

By sending an email to the entire organization

By blocking all developer access until issues are fixed

A security team wants to configure their SAST tool to align with their organization's security policy, which requires that all findings related to authentication be treated as high priority. What is the best way to achieve this?

Use the tool's default severity ratings and manually review all authentication findings.

Disable all rules related to authentication to reduce noise.

Configure the tool to automatically fix authentication issues.

Create custom rules that specifically target authentication-related code patterns and assign them a high severity.

Why is it important to configure a static analysis tool to align with organizational security policies?

To allow the tool to automatically fix all vulnerabilities

To ensure the tool enforces the specific security rules and standards that the organization has adopted

To prevent developers from seeing the results

What is the primary purpose of static security testing tools in the software development lifecycle?

To encrypt source code to protect it from unauthorized access

To identify security vulnerabilities by analyzing source code without executing the application

To detect vulnerabilities by sending malicious inputs to a running application

To monitor production traffic for suspicious activity

Certified Tester Security Test Engineer

Domain 9Objective 4

Static Security Test Tools CT-STE Practice Questions (Page 3)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 11–15

11expert · hard
A security engineer is evaluating the effectiveness of their SAST tool. They notice that the tool does not flag a known vulnerability that exists in the codebase. The vulnerability is in a function that is called indirectly through a function pointer. What is the most likely reason the SAST tool missed this vulnerability?
Select an answer first
12foundation · easy
What is a common way to provide feedback from static analysis tools to developers in a CI/CD workflow?
Select an answer first
13application · medium
A security team wants to configure their SAST tool to align with their organization's security policy, which requires that all findings related to authentication be treated as high priority. What is the best way to achieve this?
Select an answer first
14foundation · easy
Why is it important to configure a static analysis tool to align with organizational security policies?
Select an answer first
15foundation · easy
What is the primary purpose of static security testing tools in the software development lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.