Which outcome indicates a potential security flaw when using a fuzzing tool?

The application crashes or becomes unresponsive

The application logs the input to a file

The application displays a welcome message

The application returns a normal HTTP 200 response

A security tester is analyzing a mobile app's API traffic. The app uses HTTPS. To view and modify the traffic, the tester needs to install a custom CA certificate on the testing device. What is the purpose of this step?

To prevent the app from detecting the proxy.

To bypass the app's certificate pinning.

To allow the interception proxy to decrypt and inspect the HTTPS traffic.

To speed up the app's network requests.

A security tester is analyzing a web application's authentication mechanism. The tester wants to intercept and modify the login request to test for authentication bypass. Which tool is most appropriate for this task?

A static analysis tool like SonarQube

A fuzzing tool like Peach Fuzzer

A network vulnerability scanner like Qualys

An interception proxy like Burp Suite

A network administrator wants to identify unpatched services on a set of internal servers. The administrator has a list of IP addresses and needs a tool that can scan the network and report missing patches. Which tool is most appropriate?

An interception proxy like Fiddler

A web application scanner like Acunetix

A network vulnerability scanner like Nessus

Which type of vulnerability is most likely to be detected by dynamic analysis?

An outdated library version in the dependency manifest

A hardcoded password in the source code

A missing security header in the HTTP response

A buffer overflow that causes a crash during execution

Certified Tester Security Test Engineer

Domain 9Objective 8

Understand the Usage and Concepts of Dynamic Test Tools CT-STE Practice Questions (Page 6)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

Questions 26–30

26foundation · easy
Which outcome indicates a potential security flaw when using a fuzzing tool?
Select an answer first
27application · medium
A security tester is analyzing a mobile app's API traffic. The app uses HTTPS. To view and modify the traffic, the tester needs to install a custom CA certificate on the testing device. What is the purpose of this step?
Select an answer first
28application · medium
A security tester is analyzing a web application's authentication mechanism. The tester wants to intercept and modify the login request to test for authentication bypass. Which tool is most appropriate for this task?
Select an answer first
29application · medium
A network administrator wants to identify unpatched services on a set of internal servers. The administrator has a list of IP addresses and needs a tool that can scan the network and report missing patches. Which tool is most appropriate?
Select an answer first
30foundation · easy
Which type of vulnerability is most likely to be detected by dynamic analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.