A security team wants to automatically detect vulnerabilities by sending crafted HTTP requests to a running application and analyzing the responses. Which type of testing tool is designed for this purpose?

SAST (Static Application Security Testing)

DAST (Dynamic Application Security Testing)

IAST (Interactive Application Security Testing)

Certified Secure Software Lifecycle Professional

Domain 6Objective 2

Develop Security Test Cases CSSLP Practice Questions (Page 5)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

12concepts

14%of the exam

Questions 21–25

21foundation · easy
A tester feeds a web application a large number of unexpected, malformed, or random inputs to see if it crashes or behaves unexpectedly. This testing technique is called:
Select an answer first
22foundation · easy
A security team hires an external firm to simulate real-world attacks against their application to evaluate the effectiveness of security controls. This activity is best described as:
Select an answer first
23foundation · easy
A tester creates test cases that simulate a user attempting to access another user's account by manipulating session tokens, even though this is not a normal usage pattern. This testing activity is best described as:
Select an answer first
24foundation · easy
A security team wants to automatically detect vulnerabilities by sending crafted HTTP requests to a running application and analyzing the responses. Which type of testing tool is designed for this purpose?
Select an answer first
25foundation · easy
During a security review, the team compiles a list of all URLs, APIs, file upload endpoints, and background job entry points that an external user could interact with. Which security testing activity does this directly support?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Develop Security Test Cases CSSLP Practice Questions (Page 5)

Questions 21–25

A tester feeds a web application a large number of unexpected, malformed, or random inputs to see if it crashes or behaves unexpectedly. This testing technique is called:

A security team hires an external firm to simulate real-world attacks against their application to evaluate the effectiveness of security controls. This activity is best described as:

A tester creates test cases that simulate a user attempting to access another user's account by manipulating session tokens, even though this is not a normal usage pattern. This testing activity is best described as:

A security team wants to automatically detect vulnerabilities by sending crafted HTTP requests to a running application and analyzing the responses. Which type of testing tool is designed for this purpose?

During a security review, the team compiles a list of all URLs, APIs, file upload endpoints, and background job entry points that an external user could interact with. Which security testing activity does this directly support?

Keep studying — Secure Software Testing