System, Acceptance, and Maintenance CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has just applied a critical security patch to its web server. The patch addresses a remote code execution vulnerability. What is the most important security testing activity to perform after applying the patch?

   • AVerify that the patch is effective by attempting to exploit the vulnerability in a test environment.
   • BReview the patch's release notes for known issues.
   • CCheck the patch's checksum to ensure it is the official patch.
   • DWait for the next scheduled maintenance window to test the patch.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which security testing activity is essential during software maintenance to ensure that changes do not introduce new vulnerabilities?

   • ALoad testing of the database
   • BPerformance testing of the entire system
   • CUsability testing of new features
   • DRegression testing of security functionality
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is in system testing for a new patient portal. The security requirements specify that PHI must be encrypted in transit and at rest, and that role-based access control must restrict data to authorized users. The test team has completed functional testing of the portal's features. What should the security testers do next to verify the security requirements are met?

   • AConduct a code review only, since functional testing already validated the portal's behavior.
   • BExecute security test cases that verify encryption and access control, integrated with functional and non-functional tests.
   • CDefer security testing until user acceptance testing to avoid duplicating efforts.
   • DPerform a penetration test against the production environment to validate the security controls.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial institution is preparing for acceptance testing of a new online banking system. The contract with the client specifies that the system must enforce multi-factor authentication (MFA) for all financial transactions. The client's user acceptance team will test the system. What should the security testers provide to support the acceptance testing?

   • AA set of security test cases that map to the contractual MFA requirement, for the user acceptance team to execute.
   • BA vulnerability scan report from the system testing phase, without additional guidance.
   • CA list of security requirements that the system does not meet, to be addressed after deployment.
   • DA recommendation to skip user acceptance testing and rely on the system test results.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A maintenance team is adding a new feature to an existing application that allows users to upload profile pictures. The feature includes image processing. What security testing should be performed to ensure the new feature does not introduce vulnerabilities?

   • APerform a full penetration test of the entire application after the feature is added.
   • BSkip testing because the feature is small and unlikely to cause issues.
   • COnly test the new feature's functionality without security considerations.
   • DTest the image upload functionality for malicious file uploads and perform regression testing on existing features.
   Reveal Solution Discussion Select an answer first