Security Test Maintenance CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's security testing team maintains a suite of tests for its mobile application. The company has just released a new version of the app that includes a new feature allowing users to log in with biometric authentication. The existing test suite does not cover this new feature. What is the most appropriate action for the team?

   • AAdd new test cases that specifically target the biometric authentication feature, including its security controls.
   • BRun the existing test suite to ensure the new feature did not break any existing functionality.
   • CSkip testing the biometric feature because it is a standard authentication method provided by the operating system.
   • DUpdate the existing authentication test cases to include biometric authentication without adding new cases.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key aspect of managing security test assets?

   • ASharing test assets only with the test team, not with developers
   • BKeeping test documentation and tools up to date and accessible
   • CStoring test assets in a single location without version control
   • DDeleting old test data to save storage space
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security tester is updating a test case for a login form. The original test case checks for SQL injection in the username field. After a recent application update, the login form now uses a JavaScript-based input validation that blocks certain characters client-side. The tester needs to ensure the test case still provides meaningful coverage. What is the most appropriate update to the test case?

   • AModify the test case to send malicious payloads directly to the server endpoint, bypassing the client-side validation.
   • BKeep the test case unchanged and run it through the browser to see if the validation blocks the payload.
   • CRemove the SQL injection test case because the client-side validation now blocks the malicious input.
   • DUpdate the test case to only test the client-side validation logic to ensure it blocks malicious input.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security testing team has been using a shared spreadsheet to track test cases, results, and vulnerabilities. Over time, the spreadsheet has become difficult to maintain, with multiple versions and inconsistent data entry. The team wants to improve the management of its test assets to ensure they remain accurate, accessible, and reusable. What is the most appropriate action?

   • ADelete old test cases and results to simplify the spreadsheet.
   • BContinue using the spreadsheet but create a new version each time a change is made.
   • CAssign one team member to be the sole owner of the spreadsheet to ensure consistency.
   • DMigrate the test assets to a dedicated test management tool with version control and access controls.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of security test maintenance within the security testing lifecycle?

   • ATo document security tests for compliance audits only
   • BTo reduce the number of security tests to lower the overall testing cost
   • CTo ensure that security tests remain relevant and effective as the system, environment, and threat landscape evolve
   • DTo replace all existing security tests with new ones after each system release
   Reveal Solution Discussion Select an answer first