Security Test Design CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of attack surface analysis in security test design?

   • ATo identify and enumerate the points where an attacker could interact with the system
   • BTo verify that all security requirements are traceable to test cases
   • CTo measure the performance impact of security controls on the system
   • DTo determine the number of security vulnerabilities that have been fixed in the current release
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security tester is planning the testing effort for a new application. The application has a large attack surface, but the testing budget is limited. The tester must decide which parts of the application to test first. Which approach BEST aligns with the principle of risk-based testing?

   • APrioritize testing of the components that handle sensitive data or are exposed to untrusted users
   • BTest all components equally to ensure complete coverage
   • CTest the components that were most recently developed, as they are likely to have more bugs
   • DFocus on the components that are easiest to test to maximize the number of test cases
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A tester is designing security tests for a legacy application that is being migrated to the cloud. The application has a known critical vulnerability that cannot be patched in the current release. The business has decided to accept the risk for the next quarter. The tester has a limited budget for security testing. What is the MOST appropriate action for the tester?

   • ARe-test the vulnerability to confirm it still exists, then document it as out of scope
   • BReport the vulnerability as a blocker and refuse to proceed with testing until it is fixed
   • CFocus all testing effort on other parts of the application to ensure no new vulnerabilities are introduced
   • DDesign compensating control tests to verify that the vulnerability cannot be exploited through the cloud environment's security layers
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which principle is fundamental to risk-based security testing?

   • AUsing only automated tools to ensure objective and repeatable test results
   • BPrioritizing test activities based on the likelihood and impact of potential security failures
   • CTesting all possible input combinations to ensure complete coverage
   • DExecuting all security tests in the same order as the system requirements are documented
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security tester is designing test cases for a new mobile application that stores data locally on the device. The tester has identified a risk of sensitive data exposure if the device is lost or stolen. Which test case is MOST directly aligned with this risk?

   • AAttempt to read the application's local storage files on a rooted/jailbroken device
   • BTest the application's network communication to see if data is encrypted in transit
   • CCheck the application's permissions to see if it requests access to the camera
   • DVerify that the application requires a strong password to log in
   Reveal Solution Discussion Select an answer first