Sequential Development Models CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a defining characteristic of a sequential development model such as the Waterfall model?

   • ATesting is performed continuously from the start of the project to its completion.
   • BPhases are completed in a fixed order with each phase finishing before the next begins.
   • CDevelopment cycles are repeated in short iterations with continuous feedback.
   • DRequirements are allowed to evolve throughout the project based on stakeholder feedback.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A government contractor is starting a new project using a Waterfall model. The security team has been asked to ensure that security is considered from the very beginning. The project manager wants to know the first concrete security deliverable that should be produced. What should the security team create first?

   • AA set of security test cases for the final acceptance phase
   • BA security requirements specification and a security test plan
   • CA threat model of the proposed architecture
   • DA static code analysis tool configuration for the development team
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has just deployed a new version of its application to production. A week later, a critical vulnerability is found in a third-party library used by the application. The vendor has released a patch. What is the most appropriate sequence of actions for the security team in the maintenance phase?

   • AApply the patch, then run a security regression test to ensure the fix does not break existing security controls
   • BApply the patch and immediately move on, since the vendor released it
   • CWait for the next scheduled maintenance window, regardless of the severity
   • DDo not apply the patch because it might break the application
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security tester is planning the testing phase for a V-model project. The threat model identified 20 distinct threats, and the security requirements list 15 specific requirements. The tester has limited time and budget. What is the most effective strategy for prioritizing security tests?

   • APrioritize tests based on the risk rating of each threat and the likelihood of exploitation
   • BTest all threats and requirements equally to ensure complete coverage
   • COnly test the threats that are easiest to exploit
   • DOnly test the requirements that are easiest to verify
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A project is using a Waterfall model to build a new healthcare application. During the requirements phase, the security team has defined a set of security requirements. However, the business stakeholders are pushing to reduce the scope of these requirements to save time. The security lead knows that some of the requirements are mandated by healthcare regulations. What is the most appropriate action?

   • AEscalate the issue to the development team to decide
   • BRemove the requirements but document them as 'deferred' to be added later
   • CClearly identify which requirements are regulatory mandates and cannot be removed, and negotiate only on non-mandatory requirements
   • DAgree to remove all security requirements to keep the project on schedule
   Reveal Solution Discussion Select an answer first