When applying a standard-based oracle, what is the tester's primary action?

Modify the standard to fit the system's current implementation

Compare the system's actual behavior against the expected behavior defined by the standard

Ignore the standard if the system is already in production

Use the standard only to generate test data

A security tester is verifying that a payment application encrypts cardholder data during transmission. Which PCI DSS requirement should the tester use as the oracle to define the expected behavior?

Requirement 3.4, which requires that cardholder data be rendered unreadable when stored.

Requirement 8.2.1, which requires that all users have a unique ID for authentication.

Requirement 4.1, which mandates the use of strong cryptography and security protocols to protect cardholder data during transmission over open, public networks.

Requirement 10.2, which requires that all access to cardholder data is logged.

How can a best-practice-based oracle guide test design?

By identifying specific security behaviors that the system should exhibit, which become test cases

By determining the exact number of test cases needed

By providing a list of all possible vulnerabilities in the system

By replacing the need for test oracles

A security tester is assessing a web application that is subject to PCI DSS. The tester finds that the application uses a custom encryption algorithm for storing cardholder data. The algorithm is not publicly vetted. Which PCI DSS requirement should the tester use as the oracle to evaluate this finding?

Requirement 4.1, which requires the use of strong cryptography and security protocols to protect cardholder data during transmission.

Requirement 3.6.1, which requires that cryptographic keys be generated using strong cryptographic algorithms.

Requirement 3.5.1, which requires that cryptographic keys be protected against disclosure and misuse.

Requirement 3.4, which requires that cardholder data be rendered unreadable using strong cryptography.

What is the key difference between a mandatory standard and a voluntary best practice when used as a test oracle?

Mandatory standards are legally or contractually required, while best practices are recommended but not required

Mandatory standards are always more secure than best practices

Best practices are always derived from mandatory standards

Mandatory standards are only applicable to government systems

Certified Tester Security Test Engineer

Domain 4Objective 5

Test Oracles Extracted from Standards and Best Practices CT-STE Practice Questions (Page 3)

Part of the Standards and Best Practices domain, which makes up ~10% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

6 Concepts in This Objective

Identify standards and best practices as test oracles
Extract test oracles from security standards
Extract test oracles from best practices
Apply standards-based oracles to security testing
Apply best-practice-based oracles to security testing
Compare and contrast standards and best practices as oracles

Questions 11–15

11foundation · easy
When applying a standard-based oracle, what is the tester's primary action?
Select an answer first
12application · medium
A security tester is verifying that a payment application encrypts cardholder data during transmission. Which PCI DSS requirement should the tester use as the oracle to define the expected behavior?
Select an answer first
13foundation · easy
How can a best-practice-based oracle guide test design?
Select an answer first
14expert · hard
A security tester is assessing a web application that is subject to PCI DSS. The tester finds that the application uses a custom encryption algorithm for storing cardholder data. The algorithm is not publicly vetted. Which PCI DSS requirement should the tester use as the oracle to evaluate this finding?
Select an answer first
15foundation · easy
What is the key difference between a mandatory standard and a voluntary best practice when used as a test oracle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.