Objective: Security CT-ACT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   Which of the following is an example of a security risk that should be considered in acceptance testing?

   • AThe system may be slow during peak usage.
   • BAn attacker may exploit a vulnerability to gain unauthorized access to customer data.
   • CA user may enter invalid data causing a system error.
   • DThe user interface may be difficult to navigate.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which security objective is primarily concerned with ensuring that data has not been altered or corrupted?

   • AAvailability
   • BAuthentication
   • CConfidentiality
   • DIntegrity
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During security acceptance testing of a corporate web application, a tester attempts to inject malicious SQL code into a login form. The application returns an error message that reveals the database table structure. The tester documents this as a finding. What should the team do next to determine if this is a release-blocking issue?

   • AAssess the severity of the information disclosure and its potential impact on the system's confidentiality requirement
   • BImmediately fix the error message and retest the login form
   • CIgnore the finding because the injection did not return actual data
   • DReport the finding to the development team and close the test cycle
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During security acceptance testing of a new document management system, a tester attempts to upload a file with a malicious script embedded in its metadata. The system accepts the file and stores it without sanitization. The tester documents this as a finding. What should the tester do next?

   • ADelete the uploaded file and continue testing other scenarios
   • BRetest the upload with a different malicious script to confirm the issue
   • CIgnore the finding because the script is in metadata, not in the file content
   • DEvaluate the potential impact of the stored malicious script and report it as a security defect
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A team is designing security acceptance tests for a new hospital management system. The system allows doctors to prescribe medications, nurses to update patient vitals, and administrators to manage user accounts. The team wants to identify all the ways an attacker could interact with the system to cause harm. Which technique should the team use to systematically identify these interaction points?

   • AThreat modeling to identify the most likely attack vectors
   • BAttack surface analysis to identify all entry points, such as the prescription, vitals, and account management features
   • CPenetration testing to actively exploit vulnerabilities
   • DAbuse case design to describe how each user role might misuse their privileges
   Reveal Solution Discussion Select an answer first