Addressing Security Risks in Test Design CT-STE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of an attack surface component?

   • AThe development team's code repository
   • BThe project's test plan document
   • CA public-facing web API endpoint
   • DThe internal database schema
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of monitoring in a security test environment?

   • ATo prevent testers from accessing the internet.
   • BTo ensure that testers do not exceed their allocated time.
   • CTo observe and record the behavior of the system during security tests.
   • DTo automatically fix any vulnerabilities found during testing.
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   A security test engineer is updating the test plan for a legacy application. The application has a known vulnerability in the file upload feature, but the risk is considered low because the application is only accessible from the internal network. The engineer must incorporate security considerations into the test plan. What should the engineer do?

   • AInclude the file upload test in the test plan but mark it as low priority.
   • BSkip the file upload test and focus on higher-risk areas.
   • CExclude the file upload feature from security testing because the risk is low.
   • DAdd a security test objective to verify that the file upload feature rejects malicious files.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of establishing traceability between security tests and the risks they address?

   • ATo verify that each identified risk is mitigated by at least one test.
   • BTo determine the total number of test cases needed.
   • CTo document the test environment setup.
   • DTo assign test cases to specific testers.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security test engineer is planning tests for a web application. Risk analysis identified two high-severity risks: SQL injection in the search feature and cross-site scripting in user profile fields. The team has limited time and can only fully test one of these areas. The engineer must decide which risk to address first. What should the engineer do?

   • ASkip both and test a lower-risk feature to save time.
   • BTest the XSS risk first because it is easier to test.
   • CTest the SQL injection risk first because it has a higher risk level.
   • DTest both risks equally by splitting the available time.
   Reveal Solution Discussion Select an answer first