6.2 - Conduct Security Control Testing CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester is validating that a file upload feature in a web application rejects malicious files, such as executable scripts. The tester wants to ensure that the system handles this unauthorized action appropriately. Which testing approach is most suitable?

   • AMisuse case testing that defines scenarios for uploading malicious files and verifies the system's response.
   • BBenchmark testing to measure upload performance.
   • CCoverage analysis to ensure all code paths are tested.
   • DInterface testing of the file upload API to check for input validation.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An e-commerce company wants to ensure that its website's checkout process remains functional and performs within acceptable response times during peak shopping seasons. They need a testing method that can be run regularly without requiring real user traffic. Which approach should they use?

   • ASynthetic transactions that simulate a user completing a purchase and measure response times.
   • BA manual code review of the checkout module to identify logic errors.
   • CA compliance check against PCI DSS requirements for the payment page.
   • DA penetration test that attempts to exploit vulnerabilities in the checkout process.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of coverage analysis in security testing?

   • ATo automate the testing process
   • BTo determine the cost of testing
   • CTo ensure that all relevant components and scenarios are tested
   • DTo measure the performance of the testing tools
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary use of benchmarks in system testing?

   • ATo generate synthetic transactions for load testing
   • BTo exploit vulnerabilities in the system
   • CTo ensure compliance with data protection regulations
   • DTo compare system performance against a standard or baseline
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A development team has written a new authentication module. They want to test it for vulnerabilities such as SQL injection and cross-site scripting. The module is not yet deployed, and they want to test it in a realistic runtime environment. Which testing method is most appropriate?

   • AStatic application security testing (SAST) on the source code.
   • BDynamic application security testing (DAST) against a test deployment of the module.
   • CInterface testing of the API endpoints.
   • DManual code review to identify logic errors.
   Reveal Solution Discussion Select an answer first