A security team is fuzzing a file-parsing library that accepts PDF input. They have a set of valid PDF files and want to discover memory corruption vulnerabilities. Which fuzzing approach is most appropriate for this scenario?

Network protocol fuzzing targeting the library's network interface.

Generation-based fuzzing that creates PDFs from scratch without any seed files.

Mutation-based fuzzing using the valid PDF files as seed inputs.

Manual penetration testing of the library's API endpoints.

What is the primary purpose of a fuzzing tool?

To intercept and modify HTTP requests

To scan for open ports on a network

To generate malformed or unexpected inputs to trigger crashes

To analyze source code for syntax errors

A security analyst is using a network vulnerability scanner to assess a mixed environment with both Windows and Linux servers. The scanner reports a critical vulnerability in a Windows service, but the analyst knows the service is not present on Linux servers. What should the analyst do?

Run a web application scanner to confirm the finding.

Ignore the finding because the scanner is known to produce false positives.

Treat the finding as a false positive because the service is not on Linux.

Verify the finding by checking the affected hosts' OS and service versions.

What is the primary function of an interception proxy?

To scan for open ports on a network

To analyze source code for vulnerabilities

To capture and modify traffic between clients and servers

To generate random inputs to test application stability

Certified Tester Security Test Engineer

Domain 9Objective 8

Understand the Usage and Concepts of Dynamic Test Tools CT-STE Practice Questions (Page 2)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 6–10

6application · medium
A security team is fuzzing a file-parsing library that accepts PDF input. They have a set of valid PDF files and want to discover memory corruption vulnerabilities. Which fuzzing approach is most appropriate for this scenario?
Select an answer first
7foundation · easy
What is the primary purpose of a fuzzing tool?
Select an answer first
8expert · hard
A security analyst is using a network vulnerability scanner to assess a mixed environment with both Windows and Linux servers. The scanner reports a critical vulnerability in a Windows service, but the analyst knows the service is not present on Linux servers. What should the analyst do?
Select an answer first
9foundation · easy
What is the primary function of an interception proxy?
Select an answer first
10foundation · easy
Which of the following is a category of dynamic test tools used in security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.