Develop Security Test Cases CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is validating the attack surface of a new IoT device management platform. The platform includes a web console, a mobile app API, and a device firmware update mechanism. The team has limited time and resources and must prioritize testing. Which entry point should be tested first, given that a compromise could allow an attacker to push malicious firmware to all devices?

   • AThe firmware update mechanism, because it has the highest potential impact if compromised.
   • BThe web console, because it is the most commonly used interface.
   • CThe mobile app API, because it is exposed to the internet.
   • DAll entry points equally, since they are all part of the attack surface.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer is writing a fuzzing test for a file upload feature that accepts PDF files. The test should generate malformed PDFs by mutating valid files and also create completely random data to send to the upload endpoint. Which approach best implements this fuzzing strategy?

   • AUse a single fuzzer that randomly selects between valid and invalid PDF files from a public corpus.
   • BUse a mutation-based fuzzer that flips bits in valid PDF files, and a generation-based fuzzer that creates random data from a PDF grammar.
   • CUse only a mutation-based fuzzer that flips bits in valid PDF files.
   • DUse only a generation-based fuzzer that creates random data from a PDF grammar.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A development team integrates security tests into their CI/CD pipeline so that every code commit triggers automated security checks. This practice is best described as:

   • APenetration testing
   • BContinuous testing
   • CRegression testing
   • DUnit testing
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A developer is writing unit tests for a new input validation function. The function is used to sanitize user input before it is stored in a database. The developer wants to ensure that the tests cover all branches of the function, including error handling for invalid input types. Which approach best achieves this?

   • AWrite unit tests only for the valid input cases.
   • BUse a DAST scanner to test the function in the running application.
   • CWrite unit tests that cover all branches of the function, including error paths, and measure code coverage.
   • DWrite integration tests that call the function through the database layer.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security tester is developing test cases for a new online banking application. The tester wants to simulate a user attempting to transfer funds to an account they don't own, and also simulate a user trying to access another user's account by manipulating the session ID. Which testing approach best covers these scenarios?

   • ARun a DAST scanner to automatically detect these vulnerabilities.
   • BPerform fuzzing on the session ID parameter to see if it can be guessed.
   • CConduct a penetration test focusing on network-level attacks.
   • DDevelop misuse case tests that simulate unauthorized fund transfers and session ID manipulation.
   Reveal Solution Discussion Select an answer first