A static analysis tool reports a high-severity vulnerability in a module that is rarely used and has no external input. The security team is concerned about the tool's accuracy. What is the most likely explanation for this finding?

The tool is misconfigured and should be replaced

The tool is correctly identifying a vulnerability that only occurs at runtime

The module is definitely vulnerable and must be fixed immediately

The tool produced a false positive due to lack of runtime context

A development team wants to reduce the number of security issues found during code review. They plan to introduce a static analysis tool. What is the most effective way to ensure developers use the tool and benefit from it?

Integrate the tool into the IDE and provide training on interpreting findings

Run the tool only on the CI server and email reports to the team

Use the tool only during a security audit at the end of the project

Require developers to run the tool manually before each commit

Why can configuration issues be a challenge for static security testing?

Static tools are unable to parse configuration files in any format.

Static tools may not detect misconfigurations that only affect the application at runtime.

Configuration issues are not considered a security concern.

Configuration files are always encrypted and cannot be read by static tools.

A security team is evaluating tools for a web application that uses a mix of server-side Java and client-side JavaScript. They need to identify vulnerabilities that only manifest when the application is running, such as authentication bypasses that depend on runtime state. They also want to minimize false positives. Which approach is most appropriate?

Use a DAST tool in addition to SAST to cover runtime vulnerabilities

Use only a SAST tool with a low false-positive configuration

Use a manual code review for all security issues

Use a linter for both Java and JavaScript

A security test engineer is selecting a tool to automatically detect common coding mistakes, such as unused variables, potential null-pointer dereferences, and style violations, in a large codebase during development. Which type of static security tool is most appropriate for this task?

A software composition analysis tool that scans open-source dependencies for known vulnerabilities

A dynamic analysis tool that executes the application and observes runtime behavior

A SAST tool that performs deep data-flow analysis to find injection and authentication flaws

A linter that checks source code for syntax, style, and basic correctness issues

Certified Tester Security Test Engineer

Domain 9Objective 7

Understand the Usage and Concepts of Static Security Test Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

7concepts

Questions 1–5

1application · medium
A static analysis tool reports a high-severity vulnerability in a module that is rarely used and has no external input. The security team is concerned about the tool's accuracy. What is the most likely explanation for this finding?
Select an answer first
2application · medium
A development team wants to reduce the number of security issues found during code review. They plan to introduce a static analysis tool. What is the most effective way to ensure developers use the tool and benefit from it?
Select an answer first
3foundation · easy
Why can configuration issues be a challenge for static security testing?
Select an answer first
4expert · hard
A security team is evaluating tools for a web application that uses a mix of server-side Java and client-side JavaScript. They need to identify vulnerabilities that only manifest when the application is running, such as authentication bypasses that depend on runtime state. They also want to minimize false positives. Which approach is most appropriate?
Select an answer first
5foundation · medium
A security test engineer is selecting a tool to automatically detect common coding mistakes, such as unused variables, potential null-pointer dereferences, and style violations, in a large codebase during development. Which type of static security tool is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.