A company is adopting continuous deployment for a low-risk internal application. The team wants to ensure that security vulnerabilities are not introduced. They have a limited number of security testers. What is the most effective way to balance speed and security?

Disable security scanning to speed up the pipeline

Perform security testing only after the application is in production

Automate security scanning in the pipeline and have security testers review only critical changes

Require a manual security review for every deployment

A DevOps team is experiencing frequent build failures due to flaky tests. The testers are spending a lot of time investigating these failures, which is slowing down the pipeline. The team wants to improve the reliability of the tests. What is the most effective approach?

Remove the flaky tests from the pipeline to avoid delays

Identify the root causes of flakiness and fix the tests, possibly by isolating them or using better test data

Increase the timeout for each test to reduce the chance of failure

Run the flaky tests only on weekends to avoid slowing down the pipeline

A security team wants to enforce security policies across the DevOps toolchain. They need a solution that can automatically check for compliance with security standards during the build process. Which approach is most effective?

Conducting a manual security audit at the end of each sprint

Integrating a policy-as-code tool that scans infrastructure and application configurations in the pipeline

Providing security training to all developers and relying on their compliance

Using a firewall to block non-compliant traffic in production

Certified Tester Security Test Engineer

Domain 6Objective 3

The DevOps Approach CT-STE Practice Questions (Page 6)

Part of the Adjusting to Software Development Lifecycle Models domain, which makes up ~9% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 26–29

26expert · medium
A DevOps team is evaluating tools for their CI/CD pipeline. They need a tool that can orchestrate the entire pipeline, including building, testing, and deploying. They also want to integrate a separate security scanning tool. Which tool should they choose as the orchestrator?
Select an answer first
27expert · hard
A company is adopting continuous deployment for a low-risk internal application. The team wants to ensure that security vulnerabilities are not introduced. They have a limited number of security testers. What is the most effective way to balance speed and security?
Select an answer first
28expert · hard
A DevOps team is experiencing frequent build failures due to flaky tests. The testers are spending a lot of time investigating these failures, which is slowing down the pipeline. The team wants to improve the reliability of the tests. What is the most effective approach?
Select an answer first
29application · medium
A security team wants to enforce security policies across the DevOps toolchain. They need a solution that can automatically check for compliance with security standards during the build process. Which approach is most effective?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.

The DevOps Approach CT-STE Practice Questions (Page 6)

Questions 26–29

A DevOps team is evaluating tools for their CI/CD pipeline. They need a tool that can orchestrate the entire pipeline, including building, testing, and deploying. They also want to integrate a separate security scanning tool. Which tool should they choose as the orchestrator?

A company is adopting continuous deployment for a low-risk internal application. The team wants to ensure that security vulnerabilities are not introduced. They have a limited number of security testers. What is the most effective way to balance speed and security?

A DevOps team is experiencing frequent build failures due to flaky tests. The testers are spending a lot of time investigating these failures, which is slowing down the pipeline. The team wants to improve the reliability of the tests. What is the most effective approach?

A security team wants to enforce security policies across the DevOps toolchain. They need a solution that can automatically check for compliance with security standards during the build process. Which approach is most effective?

Keep studying — Adjusting to Software Development Lifecycle Models