Security Test Design CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's security policy mandates that all administrative access to production servers must require multi-factor authentication (MFA). A security tester is designing tests to verify this control is effective. Which test design approach BEST aligns with the policy verification objective?

   • AInterview the system administrator to confirm they use MFA for their daily work
   • BPerform a vulnerability scan on the production servers to identify missing security patches
   • CReview the server's system logs to check for successful login events from the past month
   • DAttempt to access the admin interface using only a valid username and password to confirm access is denied without MFA
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes the primary purpose of security test design?

   • ATo create test cases that prove the absence of all security vulnerabilities in the system
   • BTo define and prioritize security test conditions and test cases based on identified risks and the system's security objectives
   • CTo ensure that all security test cases are executed in a production environment to obtain realistic results
   • DTo document the security requirements of the system for the development team
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security tester is designing test cases for a new REST API. The organization's security standard requires that all API responses must not expose internal stack traces. Which of the following test cases is MOST aligned with this policy?

   • APerform a load test to see how the API behaves under high traffic
   • BCheck the API's rate limiting configuration to prevent denial of service
   • CSend a malformed request to the API and inspect the response body for error details
   • DReview the API's authentication mechanism to ensure tokens are required
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security tester is designing a test strategy for a critical application that is being updated. The tester has a limited time window and must choose between performing a full regression test of all existing security controls or focusing on testing the new features. The application has a history of vulnerabilities in its authentication module. What is the MOST appropriate strategy?

   • APerform a full regression test of all existing controls to ensure no old vulnerabilities are reintroduced
   • BSkip security testing and rely on the developer's code review
   • CFocus exclusively on testing the new features, as the old controls have already been tested
   • DPrioritize testing the new features, but include a focused regression test on the authentication module due to its history of vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security tester is creating a test plan for a new application. The tester has identified several risks, including SQL injection, broken authentication, and sensitive data exposure. The tester must decide how to structure the test cases. According to the principles of security test design, what is the MOST effective approach?

   • AUse a standard test case template that does not reference the specific risks
   • BFocus on testing the application's functionality to ensure it works as intended
   • CDesign a single, comprehensive test case that attempts to exploit all three risks at once
   • DDesign test cases that target each identified risk with specific inputs and expected outcomes
   Reveal Solution Discussion Select an answer first