A security test team is setting up a test environment for a series of regression tests on a web application. They want to ensure that the environment can be reproduced exactly for future test cycles. What should they do to achieve this?

Document the environment configuration, including software versions, settings, and network topology.

Keep the environment running continuously to avoid reconfiguration.

Rely on the memory of the test team to remember the configuration.

Take a snapshot of the environment and store it on a shared drive.

A security test team is setting up an environment to test a legacy application that is running on an outdated operating system. The team wants to ensure the environment is realistic, but they are concerned about the security of using an outdated OS. What is the best approach?

Use a modern OS with compatibility mode to run the legacy application.

Patch the outdated OS with all available security updates.

Run the test environment on a virtual machine with the outdated OS, but do not connect it to any network.

Use the outdated OS in the test environment, but isolate it from other networks and restrict access.

A security test team is preparing to test a critical application that integrates with several external services. The test environment is set up in a cloud provider, and the team wants to ensure that the test does not accidentally affect the external services. Which approach best balances the need for realistic testing with the need for isolation?

Connect the test environment directly to the external services, but use a firewall to restrict the traffic.

Use a VPN to connect to the external services, ensuring a secure connection.

Disable the external service integrations in the test environment.

Use mock services that simulate the external services, and configure the test environment to route all traffic to these mocks.

A security test team is setting up a test environment for a long-term project. They need to ensure that the environment remains up-to-date and secure over time. What should they include in their maintenance plan?

Only update the environment when a new test cycle begins.

Disable automatic updates to avoid changes that could affect test results.

Regularly apply security patches and updates to the test environment's operating system and applications.

Reinstall the environment from scratch before each test cycle.

Why is it necessary to document the configuration of the security test environment?

To enable reproducibility of the environment and support auditability of the testing process

To make the environment more secure

To satisfy the testers' desire to write documents

To replace the need for version control

Certified Tester Security Test Engineer

Domain 3Objective 2

The Security Test Environment CT-STE Practice Questions (Page 5)

Part of the The Security Test Process domain, which makes up ~12% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~4–6 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

Questions 21–25

21application · medium
A security test team is setting up a test environment for a series of regression tests on a web application. They want to ensure that the environment can be reproduced exactly for future test cycles. What should they do to achieve this?
Select an answer first
22expert · hard
A security test team is setting up an environment to test a legacy application that is running on an outdated operating system. The team wants to ensure the environment is realistic, but they are concerned about the security of using an outdated OS. What is the best approach?
Select an answer first
23expert · hard
A security test team is preparing to test a critical application that integrates with several external services. The test environment is set up in a cloud provider, and the team wants to ensure that the test does not accidentally affect the external services. Which approach best balances the need for realistic testing with the need for isolation?
Select an answer first
24application · medium
A security test team is setting up a test environment for a long-term project. They need to ensure that the environment remains up-to-date and secure over time. What should they include in their maintenance plan?
Select an answer first
25foundation · easy
Why is it necessary to document the configuration of the security test environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.