A security tester is evaluating access control on a multi-tenant application. The tester finds that a user from Tenant A can access data belonging to Tenant B by modifying a parameter in the URL. What is the most appropriate recommendation?

Use encryption to protect the data in the URL

Add a CAPTCHA to the URL access page

Implement server-side authorization checks for every data access request

Recommend using a web application firewall to block such requests

What is the purpose of key management in encryption?

To ensure encryption keys are generated, stored, and used securely

To reduce the size of encrypted data

To increase the speed of encryption algorithms

To provide a backup of all encrypted files

A security tester has completed testing of a firewall and an IPS. The firewall has a rule that allows all traffic from a specific partner IP range, and the IPS has a signature that blocks traffic from that range. The tester finds that legitimate traffic from the partner is being blocked by the IPS. What is the most appropriate action for the tester?

Ignore the issue because the firewall and IPS are separate systems

Recommend removing the firewall rule to allow the IPS to block the traffic

Recommend disabling the IPS signature for that partner IP range

Report the conflict between the firewall and IPS rules and recommend aligning them

Which of the following is a common method to test firewall rule effectiveness?

Checking the firewall's firmware version

Reviewing the firewall's hardware specifications

Analyzing the firewall's CPU usage

Sending test packets that should be blocked and verifying they are dropped

In a security testing strategy, what is the role of testing protective technologies?

To focus exclusively on identifying vulnerabilities in application code

To verify that protective controls are implemented and operate as intended

To replace the need for manual security reviews

To guarantee that no security vulnerabilities exist in the system

Certified Tester Security Test Engineer

Domain 2Objective 7

Testing Protective Technologies CT-STE Practice Questions (Page 1)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

10 Concepts in This Objective

Purpose of protective technologies
Types of protective technologies
Testing firewall configurations
Testing intrusion detection and prevention systems
Testing antivirus and malware protection
Testing encryption implementations
Testing access control mechanisms
Testing security logging and monitoring
Testing configuration and patch management
Interpreting test results and reporting

Questions 1–5

1expert · hard
A security tester is evaluating access control on a multi-tenant application. The tester finds that a user from Tenant A can access data belonging to Tenant B by modifying a parameter in the URL. What is the most appropriate recommendation?
Select an answer first
2foundation · easy
What is the purpose of key management in encryption?
Select an answer first
3expert · hard
A security tester has completed testing of a firewall and an IPS. The firewall has a rule that allows all traffic from a specific partner IP range, and the IPS has a signature that blocks traffic from that range. The tester finds that legitimate traffic from the partner is being blocked by the IPS. What is the most appropriate action for the tester?
Select an answer first
4foundation · easy
Which of the following is a common method to test firewall rule effectiveness?
Select an answer first
5foundation · easy
In a security testing strategy, what is the role of testing protective technologies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.