System, Acceptance, and Maintenance CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How does security testing integrate with functional and non-functional testing during system testing?

   • ASecurity testing replaces functional and non-functional testing during system testing
   • BSecurity testing is a separate activity that does not interact with functional or non-functional testing
   • CSecurity testing is performed only after all functional and non-functional testing is complete
   • DSecurity testing is integrated by verifying security requirements alongside functional behavior and by assessing security aspects of non-functional characteristics such as performance and reliability
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is planning to upgrade the database management system (DBMS) for a critical application. The upgrade changes the default encryption algorithms. What should the security testers do as part of the maintenance testing?

   • ASkip testing because the DBMS upgrade is a standard vendor update.
   • BOnly test the new encryption algorithms in isolation.
   • CPerform an impact analysis to identify affected security controls and then test those areas.
   • DDefer security testing until the next major release.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of impact analysis in the context of security testing during software maintenance?

   • ATo assess the financial cost of implementing a security fix
   • BTo identify which parts of the system may be affected by a change and thus require security testing
   • CTo determine the root cause of a security vulnerability
   • DTo measure the performance impact of a security patch
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software maintenance team is about to apply a security patch to a web application that handles user authentication. The patch modifies the session management module. What should the team do to ensure the change does not introduce new vulnerabilities?

   • AOnly test the new patch code, ignoring other parts of the application.
   • BDeploy the patch directly to production and monitor for issues.
   • CRun a full regression test suite, including security tests for session management and authentication.
   • DConduct a penetration test on the production environment after deployment.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is in the user acceptance testing phase for a new HR system. The system must allow employees to view their own salary information but not others'. The user acceptance team is testing this functionality. What is the security tester's role in this phase?

   • AReview the system's architecture for security flaws.
   • BConduct a penetration test on the production system.
   • CPerform the acceptance testing themselves instead of the user team.
   • DProvide the user acceptance team with test cases that verify the access control requirement.
   Reveal Solution Discussion Select an answer first