Addressing Security Risks in Test Design CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a security test coverage criterion?

   • AAll test environments must use the same operating system.
   • BAll testers must have at least five years of experience.
   • CAll input fields must be tested with at least one malicious input.
   • DAll test cases must be executed within one week.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of defining security test coverage criteria?

   • ATo ensure that security-relevant code paths, inputs, and behaviors are adequately tested.
   • BTo specify the test data format for all test cases.
   • CTo define the test environment's hardware requirements.
   • DTo determine the number of test cases needed for functional testing.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A security test engineer is creating test data for a login form that is vulnerable to brute force attacks. The threat model indicates that the application has an account lockout policy after five failed attempts. The engineer wants to test the effectiveness of this policy. Which test data set is most appropriate?

   • AA set of random usernames and passwords to test error handling.
   • BA set of valid usernames and passwords to verify normal login.
   • CA set of SQL injection payloads in the username field.
   • DA set of invalid passwords for a single username to trigger the lockout.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How should security considerations be integrated into test design documents?

   • ABy replacing all functional test cases with security test cases.
   • BBy adding security test cases only after all functional testing is complete.
   • CBy creating a separate document that is not shared with the test team.
   • DBy including security-specific test cases and objectives in the test plan and test cases.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A security test engineer is managing a large test suite for a financial application. The risk analysis identified several high-risk areas, and the engineer has created test cases for each. However, during a review, it is discovered that some test cases are not linked to any risk. What should the engineer do?

   • ALink each test case to the most relevant risk, even if the link is weak.
   • BRemove the test cases that are not linked to any risk.
   • CLeave the test cases unlinked because they are still valuable.
   • DReview the test cases to determine if they address any unlisted risk and update the risk register accordingly.
   Reveal Solution Discussion Select an answer first