What is the primary purpose of identification in a security context?

To record all actions performed by a user

To declare or claim an identity to the system

To determine what resources a user can access

To verify that a user is who they claim to be

A security tester is evaluating a web application that uses a single sign-on (SSO) solution based on SAML. The tester discovers that the application does not validate the 'Audience' field in the SAML assertion. Which of the following attacks is the tester MOST likely able to perform?

A cross-site scripting (XSS) attack.

A SAML assertion replay attack.

What is the purpose of testing whether authentication credentials are transmitted over an encrypted channel?

To ensure that credentials cannot be intercepted during transmission

To ensure that passwords are stored securely

To prevent unauthorized access to resources

To verify that the user is who they claim to be

Which test would specifically verify that the identification process is secure?

Testing if a user can access another user's files

Verifying that password hashes are stored securely

Checking if usernames are case-sensitive and unique

Attempting to log in with a stolen password

In security testing, why is it important to test the identification process separately from authentication?

Because identification is the only process that involves user input

Because identification errors can lead to incorrect authentication or authorization decisions

Because identification is the only process that can be tested without credentials

Because identification is the most complex security mechanism

Certified Tester Security Test Engineer

Domain 2Objective 5

Testing Identification, Authentication and Authorization CT-STE Practice Questions (Page 1)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 1–5

1foundation · easy
What is the primary purpose of identification in a security context?
Select an answer first
2expert · hard
A security tester is evaluating a web application that uses a single sign-on (SSO) solution based on SAML. The tester discovers that the application does not validate the 'Audience' field in the SAML assertion. Which of the following attacks is the tester MOST likely able to perform?
Select an answer first
3foundation · easy
What is the purpose of testing whether authentication credentials are transmitted over an encrypted channel?
Select an answer first
4foundation · easy
Which test would specifically verify that the identification process is secure?
Select an answer first
5foundation · easy
In security testing, why is it important to test the identification process separately from authentication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.