Addressing Security Risks in Test Design CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A risk is identified for a system, but no test case is linked to it. What does this indicate?

   • AThe risk is not important and can be ignored.
   • BA gap in test coverage that needs to be addressed.
   • CThe risk is automatically covered by other tests.
   • DThe risk has already been mitigated by design.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security test engineer is defining coverage criteria for a web application that processes credit card payments. The risk analysis identified a high risk of SQL injection in the payment form. Which coverage criterion is most appropriate to ensure adequate testing of this risk?

   • ABranch coverage of all decision points in the payment module.
   • BStatement coverage of all code in the payment module.
   • CPath coverage of all possible execution paths in the payment module.
   • DCoverage of all input fields in the payment form with SQL injection attack patterns.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of attack surface analysis in security testing?

   • ATo identify and analyze the areas of the system that are exposed to potential attacks.
   • BTo define the security requirements for the system.
   • CTo select the security testing tools to be used.
   • DTo determine the number of security testers required for the project.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A security test engineer is setting up a test environment for a web application that uses a third-party payment gateway. The test environment must be isolated from production, but the payment gateway is only available in the production environment. The engineer needs to test the integration with the gateway. What should the engineer do?

   • ASkip the integration test because the gateway is external.
   • BUse a mock payment gateway in the test environment.
   • CTest the integration in the production environment using test accounts.
   • DSet up a test environment that connects to the production gateway but with a firewall.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security test engineer has a limited budget and must prioritize security tests for a web application. The risk analysis identified three risks: a high-likelihood, low-impact risk in the login page; a low-likelihood, high-impact risk in the admin panel; and a medium-likelihood, medium-impact risk in the API. Which risk should be tested first?

   • AThe admin panel risk because it has the highest impact.
   • BThe login page risk because it is most likely to occur.
   • CCalculate the risk score for each and test the one with the highest score.
   • DThe API risk because it has a balanced likelihood and impact.
   Reveal Solution Discussion Select an answer first