Security Regression Testing and Confirmation Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is an important step when executing security confirmation tests?

   • ARun a completely new set of test cases that have never been executed before
   • BRe-run the exact test that previously failed, using the same test data and environment conditions
   • CSkip the test if the developer says the fix is straightforward
   • DExecute the test in a production environment to get the most realistic results
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which statement correctly distinguishes security regression testing from security confirmation testing?

   • ARegression testing verifies a specific fix, while confirmation testing checks for unintended side effects across the application
   • BRegression testing focuses on finding new vulnerabilities introduced by changes, while confirmation testing focuses on verifying that a specific defect is fixed
   • CRegression testing is performed by developers, while confirmation testing is performed by independent testers
   • DRegression testing is performed once per release, while confirmation testing is performed continuously
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to automate security regression tests and integrate them into a CI pipeline. They have a set of tests that require a specific database state. What is the best practice for managing test data?

   • AUse the production database to ensure realistic data.
   • BLet each test create its own data and clean up after itself.
   • CSkip tests that require a specific database state.
   • DUse a dedicated test database that is reset to a known state before each test run.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What should you do when a security regression test fails after a code change?

   • ARe-run the test multiple times until it passes
   • BAnalyze the failure to determine if it is a real regression or a false positive, then report the findings
   • CImmediately report the failure to stakeholders and recommend rolling back the change
   • DIgnore the failure if the code change was minor
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security tester has completed confirmation testing for a fix and all tests passed. However, a code review reveals that the fix was implemented in a way that could be bypassed under certain conditions. What should the tester do?

   • AIgnore the code review because the tests passed.
   • BInvestigate the bypass condition and add a test case to cover it.
   • CReport the fix as successful because the tests passed.
   • DClose the defect and move on to other tasks.
   Reveal Solution Discussion Select an answer first