Sequential Development Models CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of security regression testing during the maintenance phase?

   • ATo review the system's architecture for potential improvements
   • BTo identify new business requirements for the next release
   • CTo ensure that changes or patches do not introduce new security vulnerabilities
   • DTo test the system's performance under peak load
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A V-model project has reached the system testing phase. The security team has a list of security requirements from the requirements phase and a threat model from the design phase. They want to verify that the implemented system mitigates the identified threats. What is the most effective way to use these artifacts now?

   • AArchive the threat model and only test the functional requirements
   • BAsk the developers to confirm that they followed the design
   • CRe-run the threat modeling workshop to see if new threats have emerged
   • DDesign and execute security test cases that map each threat to a specific test
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security tester is new to a team that uses the V-model. The tester wants to understand how security activities are distributed across the lifecycle. Which statement accurately describes how security testing is integrated into a V-model?

   • ASecurity testing is performed only in the final testing phase, after all code is complete
   • BSecurity testing is only performed during the maintenance phase
   • CEach development phase has a corresponding testing phase, so security verification activities are defined early and executed later
   • DSecurity testing is performed continuously and in parallel with development
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of penetration testing during the testing phase?

   • ATo ensure that the system can handle expected user loads
   • BTo review the source code for security flaws
   • CTo simulate real-world attacks to identify exploitable vulnerabilities
   • DTo verify that the system meets functional requirements
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A software company has completed the implementation phase of a V-model project. The build is now deployed to a staging environment that mirrors production. The security team must verify that the application behaves securely under realistic conditions, including checking for authentication bypass and authorization flaws. Which activity should be performed now?

   • AA static code analysis of the entire codebase
   • BA security requirements review with the business stakeholders
   • CA threat modeling session with the architecture team
   • DA dynamic application security test (DAST) and a security functional test
   Reveal Solution Discussion Select an answer first