CT-STE sample questions

Question 1

A financial institution is migrating from a traditional perimeter-based security model to a Zero Trust Architecture (ZTA) following NIST SP 800-207 guidelines. The security test engineer is designing a test strategy to validate the 'Never Trust, Always Verify' principle for a critical internal banking application. The application previously relied solely on network segmentation (VLANs) for security. Which testing approach best validates the core Zero Trust requirement for this migration?

Accepted Answer

Verify that the application enforces mutual TLS (mTLS) and dynamic authorization policies for every request, regardless of the originating network location.

Answer

Confirm that the firewall rules strictly block all ingress traffic from the internet while allowing unrestricted traffic between internal application servers.

Answer

Validate that the VPN concentrator enforces Multi-Factor Authentication (MFA) for all remote employees accessing the internal network.

Answer

Ensure that the Intrusion Detection System (IDS) is configured to alert on signature-based attacks across all internal subnets.

Question 2

During a security audit of an e-commerce platform, the lead auditor requests evidence of 'Asset Security Levels' implementation. You need to demonstrate that data protection mechanisms are aligned with data sensitivity.

Given the classification scheme below:
- **Public**: Marketing data
- **Internal**: Employee directories
- **Confidential**: Customer PII
- **Restricted**: Payment Card Data (PCI)

Which test scenario provides the strongest evidence of correct implementation?

Accepted Answer

Attempting to access Restricted data using an account with clearance only for Confidential data, verifying that access is denied and the event is logged.

Answer

Verifying that Public marketing data is encrypted at rest using AES-256 encryption keys.

Answer

Confirming that Internal employee directories are accessible to anonymous users via the public API.

Answer

Checking that backup tapes for all data types are stored in the same offsite facility without labeling.

Question 3

True or False: A security audit is primarily a dynamic activity that involves executing active attacks against a system to find vulnerabilities, whereas security testing is a static verification of compliance against a checklist.

Accepted Answer

False

Answer

True

Question 4

A development team is heavily utilizing Open-Source Software (OSS) libraries in a new microservice. As the Security Test Engineer, you are concerned about supply chain attacks and transitive dependencies. Which activity should be integrated into the CI/CD pipeline to specifically address this risk?

Accepted Answer

Implementing Software Composition Analysis (SCA) to generate a Software Bill of Materials (SBOM) and alert on known vulnerabilities (CVEs) in all dependencies.

Answer

Configuring a Dynamic Application Security Testing (DAST) scanner to fuzz the application's API endpoints.

Answer

Performing manual code review of the proprietary business logic written by the internal developers.

Answer

Running static analysis (SAST) with rules focused on coding style and performance optimization.

Question 5

You are defining the security test strategy for a healthcare application handling Patient Health Information (PHI). The organization requires that no production data be used in lower environments (Dev/Test). What is the most appropriate approach for creating test data that maintains functional validity while satisfying security paradigms regarding data sensitivity?

Accepted Answer

Use Synthetic Data Generation tools to create fictitious patient records that strictly adhere to the application's data schema and validation rules.

Answer

Copy production data to the test environment and rely on the test environment's firewall to prevent unauthorized access.

Answer

Use a simple substitution cipher to obscure names and social security numbers in the production database copy.

Answer

Manually create five test users and reuse them for all load and performance testing scenarios.

Question 6

Case Study: SecureBank Zero Trust Implementation

SecureBank is implementing a Zero Trust architecture. They have identified three core pillars for their testing strategy:
1. Identity Verification
2. Device Health
3. Data Access Policy

The security test engineer needs to design a test case for the 'Device Health' pillar. The requirement states: 'Access to the core banking API must be denied if the requesting device does not have the latest EDR agent installed, even if the user credentials are valid.'

Which test procedure accurately validates this requirement?

Accepted Answer

Configure a test device with valid user credentials but disable the EDR agent service. Attempt to access the API and verify that the request is rejected with a 403 Forbidden or specific policy error.

Answer

Use a device with the EDR agent installed and attempt to access the API with an expired password. Verify access is denied.

Answer

Monitor network traffic to ensure all API requests are encrypted using TLS 1.3.

Answer

Attempt to access the API from an IP address outside the corporate geographic region using a compliant device.

Question 7

A security team is deciding between SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) for a new web application. The application uses a complex JavaScript frontend (React) and a REST API backend. The goal is to identify runtime vulnerabilities like Broken Access Control and Server-Side Request Forgery (SSRF) before production deployment. Which approach and reasoning is correct?

Accepted Answer

Select DAST because it interacts with the running application, allowing it to detect issues like Broken Access Control that rely on runtime state and server configuration.

Answer

Select SAST because it can analyze the compiled bytecode and identify memory corruption issues in the JavaScript frontend.

Answer

Select SAST because it produces fewer false positives than DAST when scanning modern Single Page Applications (SPAs).

Answer

Select DAST because it requires access to the source code to map the application logic fully.

Question 8

You are performing security testing on an IoT device that accepts binary input over a custom TCP protocol. You want to test for buffer overflows and edge-case handling by sending malformed data packets. Which technique is most appropriate?

Accepted Answer

Protocol Fuzzing

Answer

Static Code Analysis

Answer

Vulnerability Scanning

Answer

Social Engineering

Question 9

When planning a penetration test for a production banking application, which document is CRITICAL to agree upon and sign before any active testing begins to avoid legal liability and operational disruption?

Accepted Answer

Rules of Engagement (RoE)

Answer

Test Plan Strategy

Answer

Risk Acceptance Form

Answer

Non-Disclosure Agreement (NDA)

Question 10

Which security test technique is best suited for identifying 'Broken Object Level Authorization' (BOLA/IDOR) vulnerabilities in a REST API?

Accepted Answer

Manual Penetration Testing with two different user accounts

Answer

Static Application Security Testing (SAST)

Answer

Infrastructure Vulnerability Scanning

Answer

Software Composition Analysis (SCA)

Top vendors

Top exams

Free CT-STE sample questions

True or False: A security audit is primarily a dynamic activity that involves executing active attacks against a system to find vulnerabilities, whereas security testing is a static verification of compliance against a checklist.

A development team is heavily utilizing Open-Source Software (OSS) libraries in a new microservice. As the Security Test Engineer, you are concerned about supply chain attacks and transitive dependencies. Which activity should be integrated into the CI/CD pipeline to specifically address this risk?

You are performing security testing on an IoT device that accepts binary input over a custom TCP protocol. You want to test for buffer overflows and edge-case handling by sending malformed data packets. Which technique is most appropriate?

When planning a penetration test for a production banking application, which document is CRITICAL to agree upon and sign before any active testing begins to avoid legal liability and operational disruption?

Which security test technique is best suited for identifying 'Broken Object Level Authorization' (BOLA/IDOR) vulnerabilities in a REST API?

10 more free samples are waiting