Security Regression Testing and Confirmation Testing CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is automating their regression tests and wants to integrate them into a CI pipeline. They have a set of tests that require a specific network configuration that is not available in the CI environment. What is the best approach?

   • ARun those tests in a separate environment and not include them in CI.
   • BModify the tests to work without the network configuration, even if it reduces their effectiveness.
   • CConfigure the CI environment to support the required network configuration.
   • DSkip those tests in CI and run them manually before release.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is transitioning from a Waterfall to an Agile development model. They currently run security regression testing only after system testing. What change should they make to align with Agile principles?

   • ARun regression testing only when a security defect is fixed.
   • BEliminate regression testing because Agile does not require it.
   • CIntegrate security regression testing into each sprint, running a subset of tests on each iteration.
   • DContinue running regression testing only after system testing to maintain consistency.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security tester has run a regression suite and found that a test for a previously fixed authentication bypass is now failing. The developer claims the fix is still in place and the test is flaky. What should the tester do?

   • ARerun the test multiple times to determine if it is consistently failing.
   • BRemove the test from the suite because it is causing problems.
   • CAccept the developer's claim and mark the test as flaky without further investigation.
   • DImmediately report the failure as a regression and escalate to management.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In an Agile development lifecycle, when should security regression tests be scheduled?

   • AOnly at the end of the project, before final release
   • BOnly when a security defect is reported
   • CAfter each sprint, as part of the sprint review
   • DContinuously, as part of the definition of done for each user story
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevOps team wants to integrate security regression tests into their CI/CD pipeline. They have a suite of automated security tests that take 30 minutes to run. What is the most effective approach?

   • ARun the full security regression suite on every code commit to the main branch.
   • BRun the security regression suite only before major releases.
   • CRun the security regression suite manually on a separate environment after deployment.
   • DRun a subset of high-priority security regression tests on every commit and the full suite nightly.
   Reveal Solution Discussion Select an answer first