A security team is evaluating a web application for runtime vulnerabilities. They have a limited time window and need to cover as many attack surfaces as possible. Which approach is most efficient?

Use a combination of a web application scanner and an interception proxy to manually test key functionality.

Run a web application scanner with default settings.

Perform only manual testing with an interception proxy.

Use a fuzzing tool to test all input fields.

Which action can a tester perform using an interception proxy?

Compile the server's source code

Modify a request parameter before it reaches the server

Encrypt the server's hard drive

Which of the following is a known limitation of dynamic test tools?

They can detect all possible vulnerabilities

They do not require any configuration

They can produce false positives

A developer wants to fuzz a REST API to find input validation flaws. The API expects JSON payloads. Which fuzzing strategy is most effective for this scenario?

Generation-based fuzzing without a schema

Mutation-based fuzzing of valid JSON payloads

Manual testing with a few crafted payloads

Network-level fuzzing of TCP packets

Certified Tester Security Test Engineer

Domain 9Objective 8

Understand the Usage and Concepts of Dynamic Test Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 1–5

1expert · hard
A security team is evaluating a web application for runtime vulnerabilities. They have a limited time window and need to cover as many attack surfaces as possible. Which approach is most efficient?
Select an answer first
2foundation · easy
Which action can a tester perform using an interception proxy?
Select an answer first
3foundation · easy
Which of the following is a known limitation of dynamic test tools?
Select an answer first
4foundation · easy
Which vulnerability class is a web application scanner specifically designed to detect?
Select an answer first
5application · medium
A developer wants to fuzz a REST API to find input validation flaws. The API expects JSON payloads. Which fuzzing strategy is most effective for this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.