Security Test Design CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization's security policy states that all database connections from application servers must use encrypted protocols. A security tester is designing a test to verify this. Which test would provide the MOST direct evidence of compliance?

   • ACapture network traffic between the application server and the database server and analyze the protocol
   • BInterview the application developer to confirm they used an encrypted connection string
   • CReview the database server's configuration file to see if encryption is enabled
   • DCheck the application server's firewall rules to see if port 1433 is open
   Reveal Solution Discussion Select an answer first
2. 7application · hard

   A security tester has a limited testing window and must choose which of three newly discovered vulnerabilities to test first. The tester has the following data: Vulnerability A has a high CVSS score but is only exploitable by an authenticated user with low privileges. Vulnerability B has a medium CVSS score but is remotely exploitable without authentication. Vulnerability C has a low CVSS score but affects a system that processes payment card data. According to risk-based testing principles, which vulnerability should the tester prioritize?

   • AVulnerability C, because it affects payment card data, which has high business impact
   • BVulnerability A, because it has the highest CVSS score
   • CTest all three in parallel to avoid missing any critical issue
   • DVulnerability B, because it is remotely exploitable without authentication, increasing the likelihood of exploitation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which technique is used to systematically identify potential threats and vulnerabilities during security test design?

   • AState transition testing
   • BDecision table testing
   • CBoundary value analysis
   • DThreat modeling
   Reveal Solution Discussion Select an answer first
5. 9application · hard

   A security tester is creating a test plan for a new application. The tester has identified that the application uses a third-party library with a known critical vulnerability. The library is used in a feature that is only accessible to authenticated users. According to risk-based testing, how should the tester prioritize this issue?

   • ANo priority, because the library is a third-party component and not the organization's code
   • BHigh priority, because the vulnerability is critical and the library is used by the application
   • CMedium priority, because the vulnerability is critical but requires authentication to exploit
   • DLow priority, because the feature is only accessible to authenticated users
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security tester is designing tests for a new customer-facing web application. The team has identified that the application accepts file uploads from unauthenticated users and that the upload directory is web-accessible. Which security test design technique would MOST directly help the tester identify the specific attack vectors to prioritize for this feature?

   • AAttack surface analysis to enumerate all entry points and data flows into the upload functionality
   • BSecurity test process documentation to define the overall testing phases and entry criteria
   • CRisk-based testing to assign a generic high-risk rating to all file upload features
   • DCompliance-based test case generation from the organization's secure coding standard
   Reveal Solution Discussion Select an answer first