Acceptance Criteria for Security Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security test team is writing acceptance criteria for a new authentication module. They have drafted: 'The system must prevent unauthorized access.' The test lead rejects this. Which rewrite is the clearest and most testable?

   • AThe system must not allow any unauthorized access under any circumstances.
   • BThe system must reject login attempts with an incorrect password, verified by attempting five invalid logins and confirming each is denied.
   • CThe system should have strong authentication.
   • DThe system must be secure against brute force attacks.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which characteristic is essential for effective acceptance criteria?

   • AThey must be based on the tester's intuition
   • BThey must be measurable and testable
   • CThey must be vague to allow flexibility
   • DThey must be identical for all security requirements
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security test team is planning a test for a new API. They have defined acceptance criteria. What is the most appropriate way to integrate these criteria into the test execution phase?

   • AUse the acceptance criteria to design test cases that can verify each criterion.
   • BExecute tests first and then define acceptance criteria based on the results.
   • CUse the same acceptance criteria for all tests to simplify the process.
   • DDefine acceptance criteria only for the most critical security requirements.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security test team is designing tests for a new file upload feature. They have an acceptance criterion: 'The system must reject files larger than 10 MB.' They also have a test condition: 'Test that a 15 MB file is rejected.' What is the relationship?

   • AThey are the same thing and can be used interchangeably.
   • BThe acceptance criterion is a more detailed version of the test condition.
   • CThe test condition specifies a scenario to test, and the acceptance criterion defines the expected outcome.
   • DThe test condition is the expected result, and the acceptance criterion is the test input.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security test team is designing tests for a new login system. They have an acceptance criterion: 'The system must lock out an account after five failed login attempts.' They also have a test condition: 'Test that the account is locked after five failed attempts.' What is the relationship?

   • AThe acceptance criterion is a more detailed version of the test condition.
   • BThe test condition describes what to test, and the acceptance criterion defines the expected outcome.
   • CThe test condition is the expected result, and the acceptance criterion is the test input.
   • DThey are the same thing and can be used interchangeably.
   Reveal Solution Discussion Select an answer first