Agile Development Lifecycle Models CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of the feedback loop in Agile security testing within an iteration?

   • ATo compare security testing tools and select the best one
   • BTo assign security testing tasks to external vendors
   • CTo provide developers with rapid information about security defects so they can fix them before the iteration ends
   • DTo document security test results for external auditors
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In Agile development, why is it important to perform security testing within each short iteration rather than only at the end of the project?

   • ATo ensure that security testing is performed only by developers
   • BTo reduce the need for security testing expertise
   • CTo eliminate the need for a separate security test phase
   • DTo identify and fix security issues early when they are less costly to address
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security tester is working with a developer who is implementing a file upload feature. The tester identifies a potential path traversal vulnerability in the developer's code. What is the most effective way for the tester to communicate this finding?

   • AWait until the sprint review to present the finding to the product owner.
   • BSend a detailed email to the developer's manager and CC the project manager.
   • CAdd the finding to a shared spreadsheet and ask the developer to check it at the end of the sprint.
   • DWalk over to the developer's desk and explain the vulnerability, then work together to fix it immediately.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security tester is new to an Agile team. During the daily stand-up, the tester reports a detailed analysis of a security vulnerability they are investigating. The team seems disengaged and the scrum master asks the tester to keep the update brief. What is the most likely reason for the scrum master's request?

   • AThe scrum master does not value security testing.
   • BThe stand-up is meant for team coordination and identifying impediments, not for detailed technical discussions.
   • CThe team is not interested in the security of the product.
   • DThe scrum master wants to take over the security testing role.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security tester is working with a team that is new to Agile. The team is used to a phase-based approach where security testing happens at the end. The tester wants to introduce a culture of continuous security testing. Which action best aligns with the Agile principle of 'working software over comprehensive documentation'?

   • ACreate a comprehensive security test plan document that must be approved before any testing can begin.
   • BFocus on delivering a small, secure increment of functionality and demonstrate the security testing process on it.
   • CAsk the team to write a detailed security testing handbook before starting any development.
   • DInsist that the team adopts a specific security testing tool before any other changes are made.
   Reveal Solution Discussion Select an answer first