When prioritizing findings from a static analysis tool, which factor should be considered first?

The number of lines of code in the file where the issue was found

The order in which the findings were reported

The severity of the vulnerability and the exploitability in the application's context

The name of the developer who wrote the code

In a CI/CD pipeline, at which stage is a static security test tool most commonly integrated?

Only during the initial project planning phase

After code is committed and built, before deployment

Only during the final security audit

What is the purpose of customizing the rule set of a static analysis tool?

To make the tool run on a different operating system

To add or remove checks based on the technologies and risks relevant to the project

To increase the number of false positives

To change the programming language the tool analyzes

A development team is adopting a security testing toolchain. They want to catch common coding mistakes early in the IDE, enforce basic style and security rules, and also scan for known vulnerable open-source libraries. Which combination of tools best meets these needs?

A linter, a SAST tool, and a dependency scanner

A SAST tool and a dependency scanner only

A single SAST tool configured with custom rules

An organization has a coding standard that requires all input validation to be performed in a centralized validation module. The security team wants to configure their SAST tool to enforce this standard. What is the best way to achieve this?

Disable all built-in rules and rely on the tool's machine learning capabilities.

Create a custom rule that flags any input validation logic that is not in the centralized module.

Use the tool's default rule set and manually review all findings.

Configure the tool to automatically fix any code that does not follow the standard.

Certified Tester Security Test Engineer

Domain 9Objective 4

Static Security Test Tools CT-STE Practice Questions (Page 4)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 16–20

16foundation · easy
When prioritizing findings from a static analysis tool, which factor should be considered first?
Select an answer first
17foundation · easy
In a CI/CD pipeline, at which stage is a static security test tool most commonly integrated?
Select an answer first
18foundation · easy
What is the purpose of customizing the rule set of a static analysis tool?
Select an answer first
19application · medium
A development team is adopting a security testing toolchain. They want to catch common coding mistakes early in the IDE, enforce basic style and security rules, and also scan for known vulnerable open-source libraries. Which combination of tools best meets these needs?
Select an answer first
20application · medium
An organization has a coding standard that requires all input validation to be performed in a centralized validation module. The security team wants to configure their SAST tool to enforce this standard. What is the best way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.