System, Acceptance, and Maintenance CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is in the acceptance testing phase for a new system. The system must comply with industry regulations that require regular security assessments. The company plans to conduct a penetration test after deployment. What is the role of security testing during acceptance testing?

   • APerform the penetration test during acceptance testing instead of after deployment.
   • BValidate that the system's security controls meet the regulatory requirements and are ready for the post-deployment assessment.
   • CSkip acceptance testing because the post-deployment penetration test will cover security.
   • DRely on the vendor's security certification to avoid acceptance testing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is developing a new e-commerce platform. During system testing, the security team discovers that the application is vulnerable to SQL injection in the search functionality. The development team fixes the issue. What should the security testers do to verify the fix?

   • AAccept the developer's word that the fix is correct and move on.
   • BRun only the original SQL injection test cases without any additional testing.
   • CRe-run the SQL injection test cases and also test related functionality to ensure no regression.
   • DDefer verification to the acceptance testing phase.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is in the operational acceptance testing phase for a new customer relationship management (CRM) system. The operational team is responsible for monitoring and maintaining the system. What security testing activity is most relevant during this phase?

   • APerform a code review of the entire application.
   • BCheck that all user accounts have strong passwords.
   • CTest the system's user interface for usability issues.
   • DVerify that the system's logging and monitoring capabilities capture security-relevant events.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software development team is in the system testing phase for a new customer-facing application. The security requirements include that the application must not store sensitive data in logs. What should the security testers do to verify this requirement?

   • AAsk the developers to confirm that they have not included sensitive data in logs.
   • BReview the logging code and execute test cases that trigger log entries, then inspect the logs for sensitive data.
   • COnly review the logging configuration files.
   • DWait until acceptance testing to check the logs.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During system testing of a new mobile banking app, the security team is verifying that the app properly validates SSL certificates to prevent man-in-the-middle attacks. Which type of testing is this?

   • ASecurity testing integrated with functional testing
   • BOperational acceptance testing
   • CPerformance testing
   • DUser acceptance testing
   Reveal Solution Discussion Select an answer first