A security team is integrating SAST into a CI/CD pipeline that uses a build system that compiles code incrementally. The team notices that SAST scans are slow and are delaying the pipeline. Which approach best addresses the performance issue while maintaining security coverage?

Run SAST on the entire codebase only once a week.

Disable SAST for the CI pipeline and run it manually before each release.

Run SAST only on the code that changed in the current build, using incremental analysis.

Run SAST on a separate, dedicated server that is not part of the CI pipeline.

A SAST tool is analyzing a C# application that uses an ORM (Entity Framework) to query a database. The tool does not report any SQL injection vulnerabilities. Which is the most likely reason for this?

The tool has a false negative because it cannot analyze the ORM's internal query generation.

The tool is not designed to analyze C# code.

The tool has a false positive because it incorrectly assumes the ORM is safe.

The tool is correctly identifying that parameterized queries generated by the ORM are safe.

A development team uses a monorepo containing multiple microservices written in different languages. They want to integrate SAST into their CI/CD pipeline. Which approach is most effective for managing this complexity?

Run a single SAST scan on the entire repository and report all findings in one report.

Configure separate SAST jobs for each microservice, using the appropriate tool or configuration for each language, and report findings to the owning team.

Run SAST only on the most critical microservice and rely on manual code review for the others.

Use a single SAST tool that only supports one language and apply it to all services.

A company develops a mobile banking application in Kotlin and a backend service in Go. The security team wants to select a single SAST tool for both codebases. Which factor is most important to evaluate first?

Whether the tool supports both Kotlin and Go with adequate analysis depth.

Whether the tool has a graphical dashboard for reporting.

Whether the tool is open source or commercial.

Whether the tool provides a command-line interface for CI integration.

Which of the following is a typical output of a SAST tool?

A video recording of the application's user interface during a test.

A list of open ports on the production server.

A report of potential vulnerabilities with the location in the source code.

A list of all users who have logged into the application.

Certified Tester Security Test Engineer

Domain 9Objective 1

White-Box Security Test Tools CT-STE Practice Questions (Page 1)

Part of the Security Test Tools domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 1–5

1expert · hard
A security team is integrating SAST into a CI/CD pipeline that uses a build system that compiles code incrementally. The team notices that SAST scans are slow and are delaying the pipeline. Which approach best addresses the performance issue while maintaining security coverage?
Select an answer first
2expert · hard
A SAST tool is analyzing a C# application that uses an ORM (Entity Framework) to query a database. The tool does not report any SQL injection vulnerabilities. Which is the most likely reason for this?
Select an answer first
3application · medium
A development team uses a monorepo containing multiple microservices written in different languages. They want to integrate SAST into their CI/CD pipeline. Which approach is most effective for managing this complexity?
Select an answer first
4application · medium
A company develops a mobile banking application in Kotlin and a backend service in Go. The security team wants to select a single SAST tool for both codebases. Which factor is most important to evaluate first?
Select an answer first
5foundation · easy
Which of the following is a typical output of a SAST tool?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.