Develop Security Test Cases CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A development team wants to integrate security testing into their CI/CD pipeline. They currently run unit tests and build the application on every commit. They want to add automated vulnerability scanning without significantly increasing build time. The team is considering adding a DAST scan and a regression test suite. Which approach best balances security coverage and pipeline efficiency?

   • ARun the full regression suite and DAST scan on every commit.
   • BRun only the DAST scan on every commit and skip regression testing.
   • CRun the regression suite on every commit and perform DAST scans only during nightly builds.
   • DRun a DAST scan on the deployed staging environment after each build, and run the regression suite only on code changes that affect security-sensitive modules.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team is adding unit tests for a new authentication module. They want to ensure that the tests cover the critical code paths, including error handling for invalid tokens. The team also wants to integrate these tests into their CI pipeline to run on every commit. Which approach best meets these requirements?

   • AWrite unit tests only for the happy path and run them locally before each commit.
   • BUse a DAST scanner to test the authentication module in the CI pipeline.
   • CWrite integration tests that exercise the authentication module with other components.
   • DWrite unit tests for the authentication module, measure code coverage, and add the tests to the CI pipeline.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team integrates a DAST tool into their CI/CD pipeline to scan every build before deployment. After a recent code change, the DAST scan reported a new SQL injection vulnerability in a search endpoint. The team fixed the issue, but they want to ensure the fix is effective and that no other regressions were introduced. Which combination of actions best addresses this?

   • ARe-run the DAST scan on the updated build and also execute the existing regression test suite.
   • BRun only the unit tests for the search endpoint to confirm the fix.
   • CRun a single IAST scan on the updated build, as it combines DAST and regression testing.
   • DDeploy the fix to production and monitor for SQL injection attempts in logs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team is testing a payment processing system's resilience. They want to verify that the system handles a database outage gracefully without exposing sensitive data or crashing. Which testing technique is most appropriate for this scenario?

   • AMisuse case testing by attempting to access another user's payment data.
   • BFault injection to simulate a database connection failure and observe the application's error handling.
   • CStress testing by sending a high volume of payment requests.
   • DFuzzing the payment API with malformed input to see if it crashes.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A security team wants to validate the application's security behavior under conditions that closely match the production environment, including realistic data and synthetic transactions. This practice is best described as:

   • AFailure testing
   • BRegression testing
   • CUnit testing
   • DSimulation of production environment
   Reveal Solution Discussion Select an answer first