Acceptance Criteria for Security Testing CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary role of acceptance criteria in security testing?

   • ATo list all potential vulnerabilities that might exist in the system
   • BTo document the steps a tester follows when executing a security test case
   • CTo provide a clear, measurable basis for determining whether security requirements have been satisfied
   • DTo define the specific test data and tools used during execution
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security test team has completed a vulnerability scan of a web application. The acceptance criterion was: 'No critical or high vulnerabilities may remain.' The scan found two high vulnerabilities. What should the team do to verify the acceptance criteria?

   • AIgnore the high vulnerabilities because the scan also found no critical vulnerabilities.
   • BRetest the vulnerabilities to confirm they are real, and if they are, mark the criteria as met because the scan was thorough.
   • CChange the acceptance criteria to only require no critical vulnerabilities, since high ones are less severe.
   • DReport the findings and mark the acceptance criteria as not met, since the criterion was not satisfied.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security test team is about to execute a penetration test against a customer's web application. The customer has provided a set of acceptance criteria that includes 'The application must not allow unauthorized access to user data.' The test lead wants to ensure the criteria are verifiable. Which action best improves the acceptance criteria?

   • AChange the criterion to 'The application must be secure against unauthorized access.'
   • BKeep the criterion as is, because it clearly states the security objective and the tester can interpret it flexibly.
   • CReplace the criterion with a measurable statement, such as 'No user data must be accessible without authentication, verified by attempting to access a known user's profile without a session.'
   • DAdd a note that the tester should use their professional judgment to decide if unauthorized access occurred.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is alignment with security objectives important for acceptance criteria?

   • AIt ensures that the criteria directly support the overall security goals of the organization
   • BIt guarantees that all tests will pass
   • CIt makes the criteria easier to write
   • DIt eliminates the need for test execution
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security test team is preparing a test report. They have executed tests against acceptance criteria and have the results. What is the most appropriate way to report the results?

   • AProvide a subjective opinion on the overall security posture of the system.
   • BFor each acceptance criterion, state whether it was met or not met, with evidence from the test results.
   • CSummarize the overall test effort and list the number of tests executed, without detailing criterion outcomes.
   • DReport only the tests that passed, omitting failures to avoid negative findings.
   Reveal Solution Discussion Select an answer first