Apply Cloud Software Assurance and Validation CCSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following best describes the relationship between use cases and abuse cases in software testing?

   • AAbuse cases are a subset of use cases that focus on performance requirements
   • BAbuse cases are derived from use cases by considering how an attacker might misuse the system
   • CUse cases and abuse cases are independent and unrelated testing techniques
   • DUse cases are used only for functional testing, while abuse cases are used only for load testing
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   A developer is performing a security review of a cloud application's authentication module. They have full access to the source code and want to trace the logic that handles password reset tokens to find a flaw where tokens are not invalidated after use. Which testing methodology is most appropriate?

   • AAbuse case testing, which focuses on how users might misuse the application
   • BBlackbox testing, which tests the application from an external perspective without code access
   • CDynamic Application Security Testing (DAST), which tests the running application externally
   • DWhitebox testing, which examines internal code structure and logic to identify security flaws
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   A cloud application team is preparing to verify that a newly deployed expense-reporting module correctly calculates reimbursement amounts and enforces the business rule that only managers can approve expenses. Which testing activity directly verifies these business and user requirements?

   • AMeasuring the response time of the expense module under a simulated load of 500 concurrent users
   • BReviewing the source code of the expense module to identify logic errors in the reimbursement calculation
   • CSending malformed input to the expense API to see if the application crashes or exposes stack traces
   • DExecuting test cases that submit valid and invalid expense amounts and confirm the approval workflow behaves as specified
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   A security analyst is evaluating a web application that is already deployed in a cloud environment. The analyst wants to identify vulnerabilities that can be exploited through the application's HTTP interface, such as SQL injection and cross-site scripting, without having access to the source code. Which testing approach is most appropriate for this task?

   • ASoftware Composition Analysis (SCA) on the application's dependency manifest
   • BDynamic Application Security Testing (DAST) against the deployed application
   • CInteractive Application Security Testing (IAST) using an agent inside the application
   • DStatic Application Security Testing (SAST) on the source code repository
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of abuse case testing in cloud application security?

   • ATo measure the performance and scalability of the application under heavy load
   • BTo identify how an application responds to unexpected, malicious, or unauthorized inputs and actions
   • CTo verify that the application behaves correctly under normal, expected user interactions
   • DTo confirm that all user interface elements are accessible and usable
   Reveal Solution Discussion Select an answer first