A security analyst is explaining to a client why open-source software (OSS) can be more transparent than proprietary software. What is the key characteristic of OSS that enables this transparency?

The software is free of charge.

The source code is available for inspection by anyone.

The software has no known vulnerabilities.

The software is developed by a large community.

A security test manager is planning to include open-source components in a new product. The product will be sold to government agencies. What is a key consideration for the security testing plan?

Ensure the components are popular among other government agencies.

Ensure the components' licenses are compatible with government procurement requirements.

Ensure the components have no known vulnerabilities.

Ensure the components are written in a specific programming language.

A company integrates an open-source library for PDF parsing into its customer-facing web application. The library was last updated 18 months ago and has a known critical vulnerability. The security team must decide how to proceed while the application is in production. What is the most appropriate immediate action?

Remove the library entirely and implement PDF parsing from scratch.

Continue using the library because open-source projects are community-reviewed and therefore secure.

Apply a virtual patch or Web Application Firewall (WAF) rule to mitigate the vulnerability while planning a replacement.

Replace the library with a maintained alternative and re-test the integration.

A security tester is performing a code review of an open-source component that will be integrated into a critical financial application. What is the most valuable use of the tester's time?

Reviewing the component's code for security flaws, focusing on input validation and error handling.

Checking the component's license to ensure it is permissive.

Reading the component's documentation to understand its features.

Verifying that the component is popular and widely used.

How should the use of OSS affect the planning of security testing?

It should eliminate the need for security testing because OSS is inherently secure.

It should include license compliance checks and vulnerability scanning of OSS components.

It should require a full source code audit of every OSS component before use.

It should focus only on the OSS code and ignore the surrounding application code.

Certified Tester Security Test Engineer

Domain 1Objective 6

The Concept of OSS and Its Impacts on Security Testing CT-STE Practice Questions (Page 4)

Part of the Security Paradigms domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 16–20

16application · easy
A security analyst is explaining to a client why open-source software (OSS) can be more transparent than proprietary software. What is the key characteristic of OSS that enables this transparency?
Select an answer first
17application · medium
A security test manager is planning to include open-source components in a new product. The product will be sold to government agencies. What is a key consideration for the security testing plan?
Select an answer first
18application · medium
A company integrates an open-source library for PDF parsing into its customer-facing web application. The library was last updated 18 months ago and has a known critical vulnerability. The security team must decide how to proceed while the application is in production. What is the most appropriate immediate action?
Select an answer first
19application · medium
A security tester is performing a code review of an open-source component that will be integrated into a critical financial application. What is the most valuable use of the tester's time?
Select an answer first
20foundation · easy
How should the use of OSS affect the planning of security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.