Objective: Security CT-ACT Practice Questions (Page 5)

Questions 21–23

1. 21foundation · medium

   What is the primary purpose of executing security acceptance tests?

   • ATo ensure that the system is 100% secure
   • BTo verify that the system meets specified security requirements and tolerates attacks
   • CTo identify all possible vulnerabilities in the system
   • DTo fix security defects found during testing
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial services company is preparing for the release of a new trading platform. Security acceptance testing has revealed two issues: a medium-severity vulnerability that could allow a user to view another user's transaction history (requires a valid account and specific conditions), and a low-severity issue where session tokens are not invalidated after logout. The release deadline is in two days, and the team has time to fix only one issue. The product owner wants to release on time. What should the acceptance test team recommend?

   • AFix the session token issue because it is easier to fix and can be completed before the deadline
   • BRelease on time without fixing either issue because the deadline is critical
   • CFix the transaction history vulnerability because it directly violates the confidentiality requirement, and accept the session token issue as a residual risk with a documented mitigation plan
   • DDelay the release until both issues are fixed, regardless of the deadline
   Reveal Solution Discussion Select an answer first
3. 23foundation · medium

   What is the purpose of evaluating security test results?

   • ATo create new security test cases for future releases
   • BTo document the test execution process
   • CTo fix all security defects found during testing
   • DTo determine whether the system is acceptable for release and to identify residual risks
   Reveal Solution Discussion Select an answer first