Agile Development Lifecycle Models CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A product owner is writing a user story for a new customer portal. The story must include security considerations. What is the most appropriate way for the security tester to help the product owner?

   • ACollaborate with the product owner to define clear, testable security acceptance criteria for the story.
   • BTell the product owner that security is not a feature and should not be in user stories.
   • CWait until the story is fully developed and then test it for security issues.
   • DWrite the user story for the product owner and add all security requirements.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An Agile team has a CI/CD pipeline with SAST integrated. However, the SAST tool is generating a high number of false positives, causing developers to ignore its findings. The security tester wants to improve the effectiveness of the automated security testing. What is the most effective first step?

   • AWork with the team to tune the SAST tool's rules and suppress known false positives, and establish a process for triaging new findings.
   • BRemove the SAST tool from the pipeline because it is not working.
   • CReplace the SAST tool with a different one that has no false positives.
   • DAsk the developers to manually review every SAST finding to ensure none are missed.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which type of security test is most suitable for automation in an Agile environment?

   • ASocial engineering assessments
   • BManual penetration testing of business logic
   • CExploratory security testing of new features
   • DStatic application security testing (SAST) integrated into the CI/CD pipeline
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Agile principle is most directly aligned with the practice of conducting security testing early and throughout each iteration rather than only at the end of the project?

   • AWorking software is the primary measure of progress
   • BDelivering working software frequently, with a preference for shorter timescales
   • CContinuous attention to technical excellence and good design
   • DWelcoming changing requirements, even late in development
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   Midway through a sprint, the product owner changes a user story to use a different data storage service. The security tester had already written test cases for the original storage service. What is the most appropriate action for the tester to take?

   • ADiscard the old test cases and write new ones from scratch for the new service.
   • BContinue testing the original storage service because the change might be reverted.
   • CAssess the security implications of the change, update the affected test cases, and communicate any new risks to the team.
   • DAsk the product owner to revert the change to avoid rework.
   Reveal Solution Discussion Select an answer first