Security Test Maintenance CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of retesting in the context of security testing?

   • ATo update the test documentation
   • BTo test the system's performance under load
   • CTo test all security features of the system from scratch
   • DTo verify that a specific vulnerability has been fixed
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a security test cycle, a team reviews the results and finds that a test case for a session management feature has a high false-positive rate. The test case flags valid sessions as invalid, causing the team to spend significant time investigating false alarms. What is the most appropriate action for the team?

   • AAnalyze the root cause of the false positives and update the test case to reduce them.
   • BRemove the test case because it is causing too many false positives.
   • CIgnore the false positives and continue running the test case as is.
   • DIncrease the severity of the test case so that false positives are more visible.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When updating a security test case due to a system change, what should be the first step?

   • AAnalyze the impact of the change on the test case's expected results and preconditions
   • BDelete the test case and create a completely new one
   • CUpdate the test case's ID to reflect the new version
   • DRun the test case to see if it still passes
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After completing a security test cycle, a team reviews the results and finds that a particular test case for a file upload feature has never detected a vulnerability in the last five cycles, even though the feature has been changed multiple times. The team also notices that the test case only tests for a limited set of file types. What is the most appropriate action for the team to take?

   • AIncrease the frequency of running this test case to increase the chance of finding a vulnerability.
   • BAnalyze the test case to determine if it is still effective and update it to cover a broader range of file types and attack vectors.
   • CRemove the test case because it has not found any vulnerabilities in recent cycles.
   • DKeep the test case unchanged because it has been part of the suite for a long time.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security tester is performing regression testing after a security fix. The regression suite includes a test case that verifies the system's response to a malformed request. The test case fails, and the tester investigates and finds that the fix changed the error handling behavior. The new behavior is more secure, but the test case was not updated. What is the most appropriate action?

   • AKeep the test case as is and document the failure as a known issue.
   • BUpdate the test case to reflect the new, more secure error handling behavior.
   • CReport the test failure as a regression because the behavior changed.
   • DRemove the test case because it is no longer valid.
   Reveal Solution Discussion Select an answer first