CT-STE sample questions

Question 1

True or False: A security audit is primarily a dynamic activity that involves executing active attacks against a system to find vulnerabilities, whereas security testing is a static verification of compliance against a checklist.

Accepted Answer

False

Answer

True

Question 2

A development team is heavily utilizing Open-Source Software (OSS) libraries in a new microservice. As the Security Test Engineer, you are concerned about supply chain attacks and transitive dependencies. Which activity should be integrated into the CI/CD pipeline to specifically address this risk?

Accepted Answer

Implementing Software Composition Analysis (SCA) to generate a Software Bill of Materials (SBOM) and alert on known vulnerabilities (CVEs) in all dependencies.

Answer

Configuring a Dynamic Application Security Testing (DAST) scanner to fuzz the application's API endpoints.

Answer

Performing manual code review of the proprietary business logic written by the internal developers.

Answer

Running static analysis (SAST) with rules focused on coding style and performance optimization.

Question 3

You are defining the security test strategy for a healthcare application handling Patient Health Information (PHI). The organization requires that no production data be used in lower environments (Dev/Test). What is the most appropriate approach for creating test data that maintains functional validity while satisfying security paradigms regarding data sensitivity?

Accepted Answer

Use Synthetic Data Generation tools to create fictitious patient records that strictly adhere to the application's data schema and validation rules.

Answer

Copy production data to the test environment and rely on the test environment's firewall to prevent unauthorized access.

Answer

Use a simple substitution cipher to obscure names and social security numbers in the production database copy.

Answer

Manually create five test users and reuse them for all load and performance testing scenarios.

Question 4

Case Study: SecureBank Zero Trust Implementation

SecureBank is implementing a Zero Trust architecture. They have identified three core pillars for their testing strategy:
1. Identity Verification
2. Device Health
3. Data Access Policy

The security test engineer needs to design a test case for the 'Device Health' pillar. The requirement states: 'Access to the core banking API must be denied if the requesting device does not have the latest EDR agent installed, even if the user credentials are valid.'

Which test procedure accurately validates this requirement?

Accepted Answer

Configure a test device with valid user credentials but disable the EDR agent service. Attempt to access the API and verify that the request is rejected with a 403 Forbidden or specific policy error.

Answer

Use a device with the EDR agent installed and attempt to access the API with an expired password. Verify access is denied.

Answer

Monitor network traffic to ensure all API requests are encrypted using TLS 1.3.

Answer

Attempt to access the API from an IP address outside the corporate geographic region using a compliant device.

Question 5

A security team is deciding between SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) for a new web application. The application uses a complex JavaScript frontend (React) and a REST API backend. The goal is to identify runtime vulnerabilities like Broken Access Control and Server-Side Request Forgery (SSRF) before production deployment. Which approach and reasoning is correct?

Accepted Answer

Select DAST because it interacts with the running application, allowing it to detect issues like Broken Access Control that rely on runtime state and server configuration.

Answer

Select SAST because it can analyze the compiled bytecode and identify memory corruption issues in the JavaScript frontend.

Answer

Select DAST because it requires access to the source code to map the application logic fully.

Answer

Select SAST because it produces fewer false positives than DAST when scanning modern Single Page Applications (SPAs).

Question 6

You are performing security testing on an IoT device that accepts binary input over a custom TCP protocol. You want to test for buffer overflows and edge-case handling by sending malformed data packets. Which technique is most appropriate?

Accepted Answer

Protocol Fuzzing

Answer

Vulnerability Scanning

Answer

Static Code Analysis

Answer

Social Engineering

Question 7

When planning a penetration test for a production banking application, which document is CRITICAL to agree upon and sign before any active testing begins to avoid legal liability and operational disruption?

Accepted Answer

Rules of Engagement (RoE)

Answer

Risk Acceptance Form

Answer

Test Plan Strategy

Answer

Non-Disclosure Agreement (NDA)

Question 8

Which security test technique is best suited for identifying 'Broken Object Level Authorization' (BOLA/IDOR) vulnerabilities in a REST API?

Accepted Answer

Manual Penetration Testing with two different user accounts

Answer

Infrastructure Vulnerability Scanning

Answer

Software Composition Analysis (SCA)

Answer

Static Application Security Testing (SAST)

Question 9

Select TWO primary advantages of performing a manual security code review over using an automated SAST tool. (Select TWO)

Accepted Answer

Ability to understand business logic and context-specific authorization flaws.

Accepted Answer

Identification of 'hard-coded secrets' that are obfuscated or split across variables.

Answer

Consistency of checking 100% of code paths every time.

Answer

Speed of execution across large codebases.

Question 10

In the context of Threat Modeling using the STRIDE methodology, which security property is violated by a 'Spoofing' threat?

Accepted Answer

Authentication

Answer

Confidentiality

Answer

Availability

Answer

Integrity

Free CT-STE sample questions