Acceptance Criteria for Security Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security test team is writing acceptance criteria for a firewall rule change. Which criterion is the most effective?

   • AThe firewall should be configured securely.
   • BThe firewall must not allow any traffic that could be dangerous.
   • CThe firewall will be reviewed by the network team to ensure it is working properly.
   • DThe firewall must block all unauthorized inbound traffic, as verified by a port scan showing no open ports except those explicitly allowed.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security test team is integrating acceptance criteria into their testing process. They are at the planning stage. What is the most appropriate action?

   • AUse the same acceptance criteria for all tests to simplify the process.
   • BDefine acceptance criteria only for the most critical security requirements.
   • CWait until after test execution to define acceptance criteria based on the results.
   • DDefine measurable acceptance criteria for each security requirement before test execution begins.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security test team is defining acceptance criteria for a new cloud storage service. The organization must comply with GDPR. Which source should they use to define criteria related to data protection?

   • AThe development team's preference for using open-source software.
   • BThe cloud provider's marketing materials.
   • CThe project manager's opinion on what is secure.
   • DThe GDPR regulation text and relevant guidance.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What does it mean when a security test result 'meets' an acceptance criterion?

   • AThe tester believes the system is secure
   • BThe test was executed without errors
   • CThe observed behavior matches the condition specified in the criterion
   • DThe test case was documented
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security test team is defining acceptance criteria for a new mobile banking app. They want to ensure the criteria reflect the organization's risk appetite. Which source should they consult?

   • AThe development team's preferred programming language.
   • BThe app's user interface design guidelines.
   • CThe marketing department's feature list.
   • DThe latest risk assessment report for the app.
   Reveal Solution Discussion Select an answer first