Objective: Security CT-ACT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   Which of the following is an example of a security acceptance test execution?

   • ARunning a load test to see how many users the system can handle
   • BSending a malicious SQL injection payload to an input field to verify the system blocks it
   • CChecking that the system displays the correct error message for invalid input
   • DAttempting to log in with an incorrect password to verify the system rejects it
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After security acceptance testing of a new inventory management system, the team has identified a finding where the system does not log failed login attempts. The security requirement states that the system must log all authentication events for audit purposes. What should the team conclude from this finding?

   • AThe team should retest with a different authentication method to confirm the finding
   • BThe system meets the security requirement because failed logins are not successful authentication events
   • CThe system does not meet the security requirement, and the finding should be reported as a defect
   • DThe finding is minor and can be ignored because it does not affect system functionality
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   In security risk assessment for acceptance testing, which factor is used to prioritize test scenarios?

   • AThe number of testers available
   • BThe potential impact and likelihood of a security threat
   • CThe number of features in the system
   • DThe cost of the testing tools
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security acceptance test is being executed on a new email system. The test plan includes a scenario to verify that the system can withstand a brute-force attack on user passwords. The tester attempts to log in with an incorrect password multiple times. After five failed attempts, the system locks the account for 15 minutes. What should the tester record as the result?

   • AInconclusive, because the tester did not verify that the lockout applies to all users
   • BPass, but the tester should also verify that the lockout can be bypassed by changing IP addresses
   • CPass, because the system correctly implemented account lockout to mitigate brute-force attacks
   • DFail, because the system should have locked the account after three attempts
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team is designing security acceptance tests for a new online banking application. The system allows users to transfer funds, view statements, and update personal information. The team wants to identify potential attack vectors that could compromise the system. Which technique would be most effective for systematically identifying how an attacker might exploit the system's features?

   • ACreate abuse cases that describe how a malicious user might misuse each feature, such as transferring funds to unauthorized accounts
   • BReview the system's architecture diagram to identify all network connections
   • CConduct a code review to find syntax errors in the application source code
   • DInterview users to understand how they typically use the application
   Reveal Solution Discussion Select an answer first