Develop Security Test Cases CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which automated testing approach combines dynamic testing with instrumentation inside the application to provide real-time feedback on vulnerabilities during runtime?

   • ASAST (Static Application Security Testing)
   • BPenetration testing
   • CIAST (Interactive Application Security Testing)
   • DDAST (Dynamic Application Security Testing)
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is validating the cryptographic implementation of a new password hashing system. They need to ensure that the hashing algorithm is resistant to brute-force attacks and that the salt generation is unpredictable. The team has access to the source code and can run tests in a controlled environment. Which approach best validates these cryptographic aspects?

   • AReview the hashing algorithm choice and salt generation code, and run statistical tests on the salt generator's output.
   • BUse a fuzzer to send random passwords to the hashing function and observe if any produce the same hash.
   • CPerform a penetration test on the authentication service to see if passwords can be cracked.
   • DRun a unit test that checks the hash output for a known password.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which testing practice is focused on verifying the correctness of individual components or functions in isolation?

   • APenetration testing
   • BUnit testing
   • CIntegration testing
   • DFuzzing
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A team is testing a new online shopping cart feature. They want to verify that the system handles a sudden spike in traffic without crashing and that it fails gracefully if the inventory service becomes unavailable. Which testing approach best addresses both concerns?

   • ARun a fuzzing test on the shopping cart API to see if it crashes with malformed input.
   • BPerform a penetration test to see if attackers can crash the system.
   • CWrite misuse case tests to simulate a user adding items to the cart in an unintended way.
   • DRun a stress test to simulate high traffic, and use fault injection to simulate the inventory service failure.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is validating the cryptographic implementation of a new authentication service. They need to ensure that the pseudorandom number generator (PRNG) produces unpredictable session tokens and that the encryption used for storing passwords is robust. The team has access to the source code and can run tests in a controlled environment. Which approach best validates these cryptographic aspects?

   • AUse a fuzzer to send random session tokens to the service and observe if any are accepted.
   • BPerform a penetration test on the authentication service to see if session tokens can be predicted.
   • CReview the source code for the PRNG and encryption, but skip runtime testing.
   • DRun statistical tests on the PRNG output to check for randomness and review the encryption algorithm and key management practices.
   Reveal Solution Discussion Select an answer first