Agile Development Lifecycle Models CT-STE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a sprint planning meeting, the product owner introduces a new user story that requires integrating a third-party payment API. The team has never used this API before. What is the most appropriate security testing activity to include in the sprint plan?

   • AAsk the product owner to remove the story because it introduces too much security risk.
   • BAssign the security tester to write the integration code to ensure it is secure.
   • CPlan a security review of the API's documentation and a proof-of-concept test to validate its security controls.
   • DDefer all security testing of the API integration until the next sprint after the feature is complete.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An Agile team is developing a critical financial application. The team has a very short sprint length of one week. The security tester is concerned that there is not enough time to perform adequate security testing. What is the most effective way for the tester to address this concern?

   • AAsk the product owner to lengthen the sprints to four weeks to allow for more testing time.
   • BPerform a full penetration test at the end of every sprint and hope that no critical issues are found.
   • CFocus on lightweight, automated security checks that can run within the one-week sprint and perform deeper manual testing on a less frequent basis.
   • DRefuse to work with the team until the sprint length is changed.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a key characteristic of a security test strategy adapted for Agile development?

   • ASecurity testing is performed only when a release is ready
   • BSecurity testing is outsourced to a separate team that tests only at the end
   • CSecurity testing is risk-based and prioritized according to the features being developed
   • DSecurity testing is documented in a fixed test plan that never changes
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An Agile team is struggling to keep up with security testing for its frequent releases. The team has a mature CI/CD pipeline. Which automation strategy would provide the most immediate and broad security feedback to developers?

   • AAutomate the scheduling of manual security review meetings.
   • BAutomate a full penetration test that runs nightly against the staging environment.
   • CAutomate static application security testing (SAST) and software composition analysis (SCA) to run on every code commit.
   • DAutomate the creation of security test documentation for every feature.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security tester joins an Agile team that deploys a web application to production at the end of every two-week sprint. The tester is asked to ensure that each release does not introduce critical vulnerabilities. The team has a CI/CD pipeline but no security tools integrated into it. What is the most effective approach for the tester to adopt?

   • ARun a full penetration test manually during the last two days of each sprint and fix any findings in the next sprint.
   • BIntegrate automated SAST and dependency scanning into the CI/CD pipeline and perform a manual security review of high-risk changes before each release.
   • CAsk the product owner to delay the release until a full security audit is completed by an external firm.
   • DPerform a comprehensive penetration test once a year and rely on that assessment for all releases.
   Reveal Solution Discussion Select an answer first