Security Regression Testing and Confirmation Testing CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a Waterfall development lifecycle, when is the most appropriate time to perform security regression testing?

   • ADuring the testing phase, after the implementation phase is complete
   • BDuring the maintenance phase, only when a security incident occurs
   • CAfter each code change, regardless of the phase
   • DDuring the requirements phase, to ensure security requirements are testable
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   In a Waterfall development model, security regression testing is scheduled after the system testing phase. What is a potential drawback of this approach?

   • ASecurity regression testing is only needed in Agile.
   • BSecurity regressions are detected late in the lifecycle, making fixes more expensive.
   • CSecurity regression testing is not possible in Waterfall.
   • DWaterfall does not require security regression testing.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a primary benefit of automating security regression tests?

   • AIt guarantees that all security vulnerabilities will be found
   • BIt reduces the need for security expertise in the testing team
   • CIt eliminates the need for manual security testing entirely
   • DIt allows tests to be run quickly and consistently after every change
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After running confirmation tests for a security fix, the test results show that the original vulnerability is no longer exploitable, but a new error is logged in the authentication module. What should the security tester do?

   • AReport the fix as successful and close the defect.
   • BRerun the confirmation test multiple times to see if the error disappears.
   • CIgnore the error because the original vulnerability is fixed.
   • DInvestigate the new error to determine if it is a regression or a side effect of the fix.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of security regression testing?

   • ATo identify all possible vulnerabilities in a new application before release
   • BTo validate that the application meets functional requirements after a code change
   • CTo verify that a specific security defect has been fixed without introducing side effects
   • DTo ensure that security fixes and changes do not introduce new vulnerabilities or break existing security controls
   Reveal Solution Discussion Select an answer first