Agile Development Lifecycle Models CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key challenge for security testing when requirements change frequently in Agile?

   • ASecurity testing can be performed only at the end of the project
   • BSecurity testing tools cannot be used in Agile
   • CSecurity test cases may become outdated quickly and need to be updated continuously
   • DSecurity testing becomes less important because requirements are not stable
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A team is in the middle of a sprint when a critical security vulnerability is discovered in a third-party library used by a feature being developed. The product owner wants to add a new user story to replace the library, but the sprint is already full. The security tester has assessed the risk as high. What is the most appropriate action?

   • AStop all development work immediately and do not resume until the library is replaced.
   • BAdd the new story to the product backlog and plan to address it in the next sprint.
   • CCollaborate with the product owner and the team to assess the risk, discuss mitigation options, and decide whether to swap out a lower-priority story or find a temporary workaround.
   • DInsist that the new story is added to the sprint, replacing a lower-priority story, because the security risk is too high to ignore.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a sprint retrospective, the team discusses that a security vulnerability was found in a feature that was delivered two sprints ago. The team wants to prevent this from happening again. What is the most valuable action for the security tester to take in this retrospective?

   • AFacilitate a discussion to identify why the vulnerability was missed and propose a process improvement, such as adding a new automated check.
   • BAssign blame to the developer who wrote the vulnerable code.
   • CSuggest that the team stop delivering new features until all old code is re-tested.
   • DAsk the product owner to deprioritize new features to allow for more manual testing time.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During which Agile ceremony would a security tester most appropriately review upcoming user stories to identify potential security risks and define security tasks for the next iteration?

   • ARetrospective
   • BSprint Planning
   • CSprint Review
   • DDaily Stand-up
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An Agile team is developing a mobile application. The security tester wants to ensure that security testing is not a bottleneck at the end of the sprint. Which practice best supports this goal?

   • ARun automated security tests as part of the CI pipeline and perform exploratory security testing on completed features during the sprint.
   • BSchedule a single, large security testing session on the last day of the sprint.
   • CPerform a comprehensive security test only on the final release candidate.
   • DAsk the developers to do all security testing themselves.
   Reveal Solution Discussion Select an answer first