Security Test Design at Component Test Level CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a risk analysis of a file-parsing component, the team notes that the component runs with elevated privileges. Which security test design technique is most appropriate to address the risk of privilege escalation?

   • AVerify that the component's documentation is up to date.
   • BRun a vulnerability scanner against the component's host operating system.
   • CTest the component's performance with large files to ensure it does not crash.
   • DCreate test cases that feed malicious files and verify the component does not grant elevated access to the attacker.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After executing security tests on a component, a tester finds that a specific input causes an unhandled exception. What is the most appropriate way to document this finding in the security test report?

   • AIgnore the finding because it only occurs with unusual input.
   • BFile a general bug report without mentioning security implications.
   • CNote that the component crashed during testing, without further details.
   • DRecord the exact input, the component version, the observed exception, and the security impact.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team is writing security test cases for a component that handles error messages. Which test case is most relevant to security?

   • AVerify that error messages do not reveal internal system details such as stack traces or SQL queries.
   • BConfirm that error messages are logged to a file.
   • CEnsure that error messages are displayed in the correct language.
   • DCheck that error messages are grammatically correct.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of security test design at the component test level?

   • ATo identify and design security tests for individual components in isolation, focusing on their specific security functions and vulnerabilities
   • BTo perform penetration testing on the complete application to find exploitable vulnerabilities
   • CTo define the overall security test strategy for the entire organization
   • DTo verify that the entire system meets its security requirements in an integrated environment
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A team is threat modeling a component that handles file uploads. They identify two risks: (1) a malicious file could exploit a parser vulnerability, and (2) a large file could exhaust memory. The team has limited test budget. Which approach best balances coverage and effort?

   • AOnly test with oversized files, assuming parser vulnerabilities are unlikely.
   • BRun a full penetration test on the entire application.
   • CPrioritize fuzzing the parser with malformed files and add a separate test for oversized files to verify memory limits.
   • DOnly fuzz the parser, ignoring the memory exhaustion risk.
   Reveal Solution Discussion Select an answer first