Security Testing and Availability Testing CT-FT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A financial institution has a web application that allows users to view account balances. The security team has identified a potential cross-site scripting (XSS) vulnerability in the application. They need to confirm the vulnerability and understand its impact. Which combination of security testing techniques would be most effective?

   • ASecurity code review by a peer developer to manually inspect the code.
   • BPenetration testing alone to exploit the vulnerability.
   • CStatic application security testing (SAST) followed by dynamic application security testing (DAST) to confirm the vulnerability.
   • DVulnerability scanning of the network infrastructure to identify open ports.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a typical risk associated with a denial-of-service (DoS) attack on a financial system?

   • AModification of transaction amounts
   • BUnauthorized access to customer data
   • CPermanent loss of all financial records
   • DTemporary unavailability of online banking services
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In which phase of the software testing lifecycle is security testing typically first introduced?

   • AMaintenance
   • BSystem testing
   • CRequirements analysis
   • DAcceptance testing
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How should availability testing be executed within the testing process for financial applications?

   • ABy the operations team without involving testers
   • BOnly when a system failure occurs in production
   • CAs a separate phase after all functional testing is complete
   • DIn a controlled environment that simulates real-world conditions
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When defining availability requirements for a financial system, what should be specified?

   • AThe minimum response time for transactions
   • BThe number of security tests to be performed
   • CThe maximum number of concurrent users the system can support
   • DThe acceptable downtime and the times when the system must be available
   Reveal Solution Discussion Select an answer first