How can the transparency of OSS enhance security testing?

It guarantees that all vulnerabilities have been found and fixed by the community.

It allows testers to access the source code to identify vulnerabilities and understand the implementation.

It ensures that the software is free from malicious code.

It eliminates the need for dynamic testing because the code is open.

A security team discovers that an open-source component used in their product has been abandoned by its maintainers and has multiple unpatched vulnerabilities. What is the most appropriate long-term action?

Fork the project and maintain it internally.

Continue using the component and rely on compensating controls.

Replace the component with a maintained alternative.

Report the vulnerabilities to the maintainers and wait for a fix.

A development team is using a package manager to install open-source libraries. They notice that one library has not been updated in over a year. What is the most appropriate action?

Remove the library and rewrite the functionality from scratch.

Update the library to the latest version, even if it is a major version.

Investigate the library's maintenance status and look for alternatives if it is abandoned.

Continue using the library because it is open source and therefore secure.

Which statement about the GNU General Public License (GPL) is true?

It requires that derivative works be distributed under the same license (copyleft).

It applies only to software developed by the Free Software Foundation.

It prohibits commercial use of the software.

It is a permissive license that allows proprietary derivative works without sharing source code.

Which of the following is a potential security risk when using OSS components?

The license may require the disclosure of proprietary code.

The source code is always publicly available, making it easier for attackers to find vulnerabilities.

The software cannot be updated without purchasing a support contract.

The project may be unmaintained, leaving known vulnerabilities unpatched.

Certified Tester Security Test Engineer

Domain 1Objective 6

The Concept of OSS and Its Impacts on Security Testing CT-STE Practice Questions (Page 2)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
How can the transparency of OSS enhance security testing?
Select an answer first
7application · medium
A security team discovers that an open-source component used in their product has been abandoned by its maintainers and has multiple unpatched vulnerabilities. What is the most appropriate long-term action?
Select an answer first
8application · medium
A development team is using a package manager to install open-source libraries. They notice that one library has not been updated in over a year. What is the most appropriate action?
Select an answer first
9foundation · easy
Which statement about the GNU General Public License (GPL) is true?
Select an answer first
10foundation · easy
Which of the following is a potential security risk when using OSS components?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.