Security Test Maintenance CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services company recently migrated its customer-facing web application from a traditional virtual machine deployment to a containerized platform using Azure Kubernetes Service (AKS). The security test team has a suite of penetration test cases that were written for the original VM-based architecture. During the next scheduled security test cycle, the team discovers that several test cases fail because they reference internal IP addresses and service names that no longer exist in the new environment. What is the most appropriate first action for the security test team?

   • AUpdate the affected test cases to reference the new AKS service names and internal IP addressing scheme, then execute the full suite.
   • BRe-run the original test cases against the old VM environment to confirm they still pass before making any changes.
   • CDelete the failing test cases because they are no longer relevant to the containerized platform.
   • DRewrite the entire test suite from scratch to ensure full coverage of the new AKS environment.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team fixed a cross-site scripting (XSS) vulnerability in a web application by adding output encoding. The security tester needs to verify the fix is effective and that no new vulnerabilities were introduced. The tester has a test case for the original XSS vulnerability and a broader regression suite. What is the most appropriate testing approach?

   • ARun only the original XSS test case to confirm the fix is effective.
   • BRun only the full regression suite, as it will include the XSS test case.
   • CRe-run the original XSS test case to confirm the fix, then run the full regression suite to check for new issues.
   • DRun the original XSS test case and only the test cases for the module where the fix was applied.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is performing regression testing after a security fix was applied to an authentication module. The regression suite includes a test case that verifies the system locks an account after five failed login attempts. The test case fails because the account is now locked after three attempts. The tester checks the fix and confirms the change was intentional to increase security. What is the most appropriate action?

   • AKeep the test case as is and document the failure as a known issue.
   • BRemove the test case because it is no longer valid.
   • CUpdate the regression test case to reflect the new account lockout threshold of three attempts.
   • DReport the test failure as a new vulnerability because the behavior changed.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can lessons learned from a security test be incorporated into future testing?

   • ABy ignoring lessons learned to avoid changing established processes
   • BBy storing lessons learned in a document that is never reviewed
   • CBy updating the test strategy and test cases to address identified gaps
   • DBy sharing lessons learned only with new testers
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security testing team has been using a set of test cases for a web application for several years. The team notices that the test cases are becoming less effective at finding vulnerabilities, as the application has evolved and the threat landscape has changed. The team wants to improve the test suite. What is the most appropriate approach?

   • AReplace the entire test suite with a new set of test cases from a commercial vendor.
   • BIncrease the frequency of running the existing test cases to improve their effectiveness.
   • CKeep the test cases unchanged because they have been used for years and are well understood.
   • DAnalyze the effectiveness of each test case, update outdated ones, and add new test cases based on lessons learned and current threats.
   Reveal Solution Discussion Select an answer first