Develop Security Test Cases CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A team is preparing to test a microservices-based application in a staging environment that mirrors production. The test must validate security behavior under realistic load and data conditions, but the staging environment uses synthetic data that does not match production data patterns. The team wants to ensure the test results are representative. Which action best addresses this gap?

   • ARun the security tests only on the production environment during off-peak hours.
   • BGenerate synthetic transactions that mimic production data patterns and run the security tests under load.
   • CIncrease the number of test cases in the staging environment to compensate for the data mismatch.
   • DUse the synthetic data as-is and rely on DAST scanning to cover all security issues.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A tester deliberately introduces faults, such as simulating a database outage or injecting errors, to verify that the application fails gracefully. This testing practice is called:

   • ARegression testing
   • BFuzzing
   • CFailure testing
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is planning a penetration test for a critical financial application. The test must validate the effectiveness of the Web Application Firewall (WAF) and the authentication controls, but the test window is limited to 48 hours. The team has a full set of credentials for a standard user account and knows the application's entry points. Which testing strategy best balances coverage and time constraints?

   • AUse the standard user credentials to test only authenticated functionality, skipping unauthenticated entry points.
   • BPerform a black-box test focusing on the WAF bypass techniques and authentication bypass attempts using the known entry points.
   • CConduct a full white-box test with source code review and dynamic scanning of all modules.
   • DRun an automated vulnerability scanner and rely on its default coverage.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer is testing a new XML parser that will be used to process customer-supplied files. The developer wants to ensure the parser handles malformed XML gracefully and doesn't crash or expose sensitive information. Which testing technique is most appropriate?

   • AWrite misuse case tests that simulate an attacker sending XML with embedded scripts.
   • BPerform a penetration test on the server hosting the parser.
   • CRun a stress test by sending a large number of valid XML files.
   • DFuzz the XML parser with malformed and unexpected XML inputs.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is integrating a new payment gateway into their existing e-commerce platform. The integration involves exchanging sensitive data between the two systems. The team wants to test the security of this integration before going live. Which testing approach is most appropriate?

   • AConduct a penetration test on the e-commerce platform only.
   • BUse fuzzing to send random data to the payment gateway API.
   • CPerform integration testing that validates data encryption, authentication, and error handling between the systems.
   • DRun unit tests on the payment gateway's code in isolation.
   Reveal Solution Discussion Select an answer first