Objective: Security CT-ACT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An e-commerce company is planning acceptance testing for a new payment processing module. The team has identified several potential security issues: a SQL injection vulnerability in the search function (high impact, high likelihood), a cross-site scripting issue in the review section (medium impact, high likelihood), and a theoretical denial-of-service risk from a misconfigured load balancer (high impact, low likelihood). The team has limited time for testing. What should the acceptance test plan prioritize?

   • ATest the SQL injection and cross-site scripting issues first, then the denial-of-service risk if time permits
   • BTest the cross-site scripting issue first because it affects user-facing content
   • CTest the denial-of-service risk first because it has the highest potential impact
   • DTest all three issues equally since they are all security risks
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   After completing security acceptance testing for a new government portal, the team has identified three findings: a high-severity issue where encrypted data can be decrypted with a known key (affects 1% of users), a medium-severity issue where user sessions do not expire (affects all users), and a low-severity issue where the password policy allows weak passwords. The system must be released next week for a regulatory deadline. The team can fix only one issue before release. Which finding should be fixed first?

   • AThe password policy issue because it is the easiest to fix
   • BThe session expiration issue because it affects all users and directly impacts the confidentiality requirement
   • CThe decryption issue because it is labeled high severity
   • DNone of the issues because the regulatory deadline is more important
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   After security acceptance testing of a new HR system, the team has identified the following findings: a critical issue where any authenticated user can view all employee salaries (affects all users), a medium issue where password reset tokens are not invalidated after use (affects a small number of users), and a low issue where the system logs contain plaintext passwords (affects all users). The release is scheduled for tomorrow, and the team can fix only one issue. Which finding should be fixed before release?

   • AThe plaintext password logging issue because it affects all users
   • BThe salary viewing issue because it is critical and affects all users, directly violating confidentiality
   • CNone of the issues because the release deadline is tomorrow
   • DThe password reset token issue because it is a security mechanism flaw
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   Which of the following is an example of a residual risk that might be identified during security test result evaluation?

   • AA test case that was not executed due to time constraints
   • BA security defect that was fixed and verified during testing
   • CA security requirement that was fully met by the system
   • DA known vulnerability that was not fixed because it was deemed low risk
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A healthcare startup is developing a patient portal that will store protected health information. During acceptance test planning, the product owner states that the system must ensure that only authorized clinicians can view patient records, that records cannot be altered without an audit trail, and that the portal remains accessible during business hours. The team is now writing acceptance test scenarios. Which set of security requirements should the acceptance tests be designed to verify?

   • APrivacy (data minimization), compliance (HIPAA), and auditing (log reviews)
   • BConfidentiality (authorized viewing), integrity (unaltered records with audit trail), and availability (accessible during business hours)
   • CEncryption (at rest and in transit), firewalls (network protection), and intrusion detection (monitoring)
   • DAuthentication (user login), authorization (role-based access), and non-repudiation (digital signatures)
   Reveal Solution Discussion Select an answer first