A team is setting up a CI pipeline for a mobile application. They want to run automated tests on every commit. Which testing tool is most appropriate for this purpose?

A load testing tool like JMeter

A unit testing framework like JUnit

A manual testing tool like a test case management system

A DevOps team wants to add automated security scanning to their CI pipeline. They need a tool that can analyze source code for known vulnerabilities. Which type of tool should they integrate?

Runtime application self-protection (RASP) tool

Static application security testing (SAST) tool

Dynamic application security testing (DAST) tool

A financial services company is adopting DevOps to accelerate feature delivery. The security team is concerned that introducing automated deployments will bypass the manual security review that currently gates every release. The team wants to keep security oversight without slowing the pipeline. Which approach best addresses this concern?

Keep the manual security review as a mandatory gate before every deployment to ensure no risk is introduced

Integrate automated security scanning tools into the CI/CD pipeline and require a security sign-off only for high-risk changes

Perform security testing only after the release to avoid delaying the pipeline

Remove the security review entirely and rely on developers to write secure code

Certified Tester Security Test Engineer

Domain 6Objective 3

The DevOps Approach CT-STE Practice Questions (Page 4)

Part of the Adjusting to Software Development Lifecycle Models domain, which makes up ~9% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 16–20

16foundation · easy
Which DevOps practice involves automatically building and testing every code change as soon as it is committed to the version control system?
Select an answer first
17application · medium
A team is setting up a CI pipeline for a mobile application. They want to run automated tests on every commit. Which testing tool is most appropriate for this purpose?
Select an answer first
18foundation · easy
Which of the following is a core principle of DevOps that emphasizes breaking down silos between development and operations teams?
Select an answer first
19application · medium
A DevOps team wants to add automated security scanning to their CI pipeline. They need a tool that can analyze source code for known vulnerabilities. Which type of tool should they integrate?
Select an answer first
20application · medium
A financial services company is adopting DevOps to accelerate feature delivery. The security team is concerned that introducing automated deployments will bypass the manual security review that currently gates every release. The team wants to keep security oversight without slowing the pipeline. Which approach best addresses this concern?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

The DevOps Approach CT-STE Practice Questions (Page 4)

Questions 16–20

Which DevOps practice involves automatically building and testing every code change as soon as it is committed to the version control system?

A team is setting up a CI pipeline for a mobile application. They want to run automated tests on every commit. Which testing tool is most appropriate for this purpose?

Which of the following is a core principle of DevOps that emphasizes breaking down silos between development and operations teams?

A DevOps team wants to add automated security scanning to their CI pipeline. They need a tool that can analyze source code for known vulnerabilities. Which type of tool should they integrate?

Keep studying — Adjusting to Software Development Lifecycle Models