Security Test Design at Component Test Level CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What should be included in the documentation of component-level security test results?

   • AThe source code of the component under test
   • BThe names of all developers who wrote the component
   • CThe personal opinions of the testers about the component's quality
   • DA clear description of any security defects found, including steps to reproduce
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security test lead wants to ensure that every identified security risk for a component has at least one corresponding test case. Which artifact should the team maintain to demonstrate this?

   • AA traceability matrix linking security risks to test cases.
   • BA test environment configuration document.
   • CA list of all test cases with their execution status.
   • DA defect report summarizing all bugs found during testing.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team is testing a component that performs cryptographic operations. They need to verify that the component correctly rejects tampered ciphertext. Which tool or test double is most appropriate for this task?

   • AA test driver that invokes the component with pre-generated valid and tampered ciphertext inputs.
   • BA network simulator to emulate the component's communication channel.
   • CA static analysis tool to scan the source code for vulnerabilities.
   • DA code coverage tool to measure how much of the component's code is executed.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the main advantage of using security-focused white-box testing at the component level?

   • AIt requires no knowledge of the component's internal implementation
   • BIt allows testers to examine the internal code and logic to identify vulnerabilities that might be missed by black-box testing
   • CIt is faster than any other security testing technique
   • DIt is the only technique that can find input validation issues
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A team is testing a component that processes user-supplied JSON data. Threat modeling identified a risk of prototype pollution. The team has limited time and must choose one security test technique. Which technique is most effective for detecting this specific vulnerability?

   • APerform a code review focusing on how the component merges objects.
   • BCreate test cases that submit JSON with keys like '__proto__' and 'constructor.prototype' and verify the component's behavior is not altered.
   • CUse a network scanner to identify exposed services.
   • DRun a generic fuzzer that generates random JSON inputs and monitors for crashes.
   Reveal Solution Discussion Select an answer first