Security Testing and Availability Testing CT-FT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which security testing technique involves simulating an attack on a system to identify exploitable vulnerabilities?

   • AVulnerability scanning
   • BPenetration testing
   • CSecurity code review
   • DRisk assessment
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial institution is preparing a mobile banking app for release. The security team is concerned about a recent spate of credential-stuffing attacks on other banks. They want to verify that the app's authentication endpoint can withstand automated login attempts without causing a denial of service to legitimate users. Which security testing technique is most appropriate to validate this specific concern?

   • ARun a vulnerability scanner that checks for missing security headers on the login page.
   • BReview the authentication logs from a previous load test to identify failed login patterns.
   • CConduct a static application security testing (SAST) scan of the login module's source code.
   • DPerform a penetration test that includes a brute-force attack simulation on the login endpoint.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A testing team is planning availability tests for a new stock trading system. The system has a service level agreement (SLA) that requires 99.99% availability. The team wants to ensure that the availability tests are meaningful and aligned with the SLA. Which action should the team take first?

   • APerform a failover test to ensure the disaster recovery site works.
   • BReview the system architecture to identify single points of failure.
   • CDefine clear availability metrics and acceptance criteria based on the SLA.
   • DExecute a full-scale load test to see if the system can handle peak trading volumes.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A financial institution is developing a new online banking platform. The security team is concerned about the risk of data breaches. They want to ensure that security testing is integrated into the development process from the start. Which approach best achieves this goal?

   • APerform security testing only after the system is fully developed to avoid interfering with development.
   • BConduct a security risk assessment at the beginning of the project and then perform security testing during the testing phase.
   • CRely on the development team to perform security testing as part of their unit testing.
   • DIntegrate security testing activities into each phase of the software development lifecycle, from requirements to maintenance.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services company is defining availability requirements for a new customer-facing payment portal. The business has stated that the portal must be available during all business hours (8 AM to 8 PM, 7 days a week) and that any outage during these hours is unacceptable. Which availability metric is most appropriate to specify in the requirements?

   • AMean time between failures (MTBF) of 30 days.
   • BAvailability percentage of 99.9% calculated over a 24/7 period.
   • CRecovery time objective (RTO) of 4 hours.
   • DAvailability percentage of 100% during the defined business hours.
   Reveal Solution Discussion Select an answer first