Security Regression Testing and Confirmation Testing CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the main objective of security confirmation testing?

   • ATo assess the overall security posture of the application against industry standards
   • BTo identify new vulnerabilities that may have been introduced by a recent code change
   • CTo ensure that all security controls in the application are working as intended after a major release
   • DTo verify that a specific security defect has been successfully fixed without side effects
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In which scenario would you perform security regression testing rather than confirmation testing?

   • AA developer has just fixed a cross-site scripting (XSS) vulnerability in a search feature, and you want to verify that the fix works
   • BYou are performing a penetration test on a new application to identify vulnerabilities before release
   • CA new feature that handles user uploads is added, and you want to ensure that existing file upload validation controls still work correctly
   • DA security test case failed during the last test cycle, and you want to re-run it to see if it still fails
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester is about to execute a set of security regression tests. The test environment has been used for other testing and may contain stale data. What should the tester do before executing the regression tests?

   • AUse production data to make the tests more realistic.
   • BOnly reset the database, but leave other configuration as is.
   • CReset the test environment to a known state and ensure test data is properly managed.
   • DRun the tests immediately to save time, as the environment is probably fine.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When is security confirmation testing typically performed?

   • AAt the end of the release cycle, as part of the final security regression suite
   • BAfter the developer has implemented a fix for a specific security defect
   • CDuring the initial security requirements analysis phase
   • DAfter a security defect is reported but before the developer starts working on the fix
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common challenge when automating security regression tests?

   • AAutomated tests cannot be integrated into CI/CD pipelines
   • BAutomated tests require a stable and consistent test environment
   • CAutomated tests do not require any maintenance
   • DAutomated tests are always slower than manual tests
   Reveal Solution Discussion Select an answer first