Security Test Design CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When designing security tests to verify compliance with an organizational security policy, what should the test cases be based on?

   • AThe specific requirements and controls defined in the policy
   • BThe most recent security incidents reported in the industry
   • CThe availability of automated testing tools in the organization
   • DThe personal preferences of the security test lead
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security tester is designing test cases for a web application that uses role-based access control (RBAC). The tester wants to verify that a user with the 'viewer' role cannot perform administrative functions. Which test case is MOST appropriate?

   • ALog in as an administrator and verify that all admin functions are accessible
   • BLog in as a 'viewer' user and attempt to access an administrative URL directly
   • CTest the application's login page for SQL injection vulnerabilities
   • DReview the RBAC configuration to see if the 'viewer' role has the correct permissions
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's security policy requires that all user passwords must be stored using a strong hashing algorithm. A security tester is tasked with verifying this. Which test design is MOST appropriate?

   • AInspect the database to see if password fields contain plaintext or a recognizable hash format
   • BReview the application's source code to see if a hashing library is imported
   • CAttempt to log in with a common weak password to see if it is accepted
   • DCheck the network traffic to see if passwords are sent in plaintext during login
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security tester is designing a test plan for a new application. The tester has identified that the application has a large number of potential entry points, but the testing budget is limited. The tester must decide which entry points to test first. Which approach BEST aligns with the principle of risk-based testing?

   • APrioritize entry points that are accessible without authentication and handle sensitive data
   • BTest the entry points that were most recently added to the application
   • CTest all entry points in a random order to ensure no bias
   • DFocus on the entry points that are easiest to test to maximize coverage
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization's security policy requires that all external-facing web applications must have a Web Application Firewall (WAF) in place. A security tester is designing a test to verify this control. Which test would provide the MOST direct evidence of compliance?

   • ACheck the WAF's configuration to see if it has a rule to block SQL injection
   • BSend a known malicious payload (e.g., SQL injection) to the application and observe if it is blocked
   • CInterview the network administrator to confirm the WAF is in place
   • DReview the network diagram to see if a WAF is placed in front of the application
   Reveal Solution Discussion Select an answer first