A team recently fixed a security vulnerability in a login endpoint by adding additional input validation. They want to ensure that the fix doesn't break existing functionality and that the vulnerability is truly resolved. Which testing approach is most appropriate?

Run the existing regression test suite and re-run the security test that originally detected the vulnerability.

Run only the new unit tests for the login endpoint.

Run a single DAST scan on the login endpoint without running regression tests.

Deploy the fix to production and monitor for user complaints.

A team recently updated a library used for authentication in their application. The update included a security patch. The team wants to ensure that the update doesn't break existing authentication flows and that the security patch is effective. Which testing approach is most appropriate?

Run only the new unit tests for the authentication library.

Run the regression test suite for authentication and re-run the security tests that the patch was meant to address.

Run a single DAST scan on the authentication endpoint without running regression tests.

Deploy the update to production and monitor for authentication failures.

Certified Secure Software Lifecycle Professional

Domain 6Objective 2

Develop Security Test Cases CSSLP Practice Questions (Page 6)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

12concepts

14%of the exam

Questions 26–30

26foundation · easy
A security tester is verifying that the application's pseudorandom number generator produces outputs that are unpredictable and suitable for cryptographic use. This activity is best described as:
Select an answer first
27foundation · easy
Which testing technique involves taking valid input data and altering it (e.g., changing values, adding characters, or corrupting fields) to create malformed inputs?
Select an answer first
28application · medium
A team recently fixed a security vulnerability in a login endpoint by adding additional input validation. They want to ensure that the fix doesn't break existing functionality and that the vulnerability is truly resolved. Which testing approach is most appropriate?
Select an answer first
29application · medium
A team recently updated a library used for authentication in their application. The update included a security patch. The team wants to ensure that the update doesn't break existing authentication flows and that the security patch is effective. Which testing approach is most appropriate?
Select an answer first
30foundation · easy
After a security fix is applied, the team re-runs the existing test suite to ensure that the fix did not break any previously working functionality. This practice is best described as:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Develop Security Test Cases CSSLP Practice Questions (Page 6)

Questions 26–30

A security tester is verifying that the application's pseudorandom number generator produces outputs that are unpredictable and suitable for cryptographic use. This activity is best described as:

Which testing technique involves taking valid input data and altering it (e.g., changing values, adding characters, or corrupting fields) to create malformed inputs?

A team recently fixed a security vulnerability in a login endpoint by adding additional input validation. They want to ensure that the fix doesn't break existing functionality and that the vulnerability is truly resolved. Which testing approach is most appropriate?

A team recently updated a library used for authentication in their application. The update included a security patch. The team wants to ensure that the update doesn't break existing authentication flows and that the security patch is effective. Which testing approach is most appropriate?

After a security fix is applied, the team re-runs the existing test suite to ensure that the fix did not break any previously working functionality. This practice is best described as:

Keep studying — Secure Software Testing