Sequential Development Models CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is part of security test planning during the requirements phase?

   • AExecuting penetration tests against the system
   • BDeploying the system to production
   • CFixing security defects found in the code
   • DDefining the scope and objectives of security testing
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A legacy application built with a Waterfall model has been in maintenance for five years. The security team has discovered that the application has a fundamental flaw in its session management, which was introduced during the original design. The team is considering a major refactor, but the business is reluctant because the application is stable and a refactor is risky. What is the most balanced approach for the security team to recommend?

   • ADo nothing because the application has been stable for five years
   • BImplement a compensating control (e.g., a web application firewall rule) to mitigate the flaw, and plan a phased refactor over time
   • CDemand an immediate full rewrite of the application
   • DDisable the session management feature entirely
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of defining security requirements during the requirements phase of a sequential model?

   • ATo identify all potential vulnerabilities in the final system
   • BTo assign security testing tasks to team members
   • CTo establish a baseline for security testing and acceptance criteria
   • DTo select the specific security testing tools to be used
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key advantage of sequential models for security testing?

   • ASecurity testing can be performed continuously throughout the project
   • BChanges to security requirements are easy to accommodate late in the project
   • CSecurity requirements can be defined early and used to guide later testing
   • DSecurity testing requires less planning because it is done at the end
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A project is in the design phase of a V-model. The threat modeling session has identified a critical vulnerability in the proposed authentication design. The project manager wants to proceed to implementation to stay on schedule, arguing that the vulnerability can be fixed during the testing phase. The security lead disagrees. What is the strongest argument for fixing the design now?

   • AThe testing phase is not designed to find authentication flaws
   • BThe threat model is always correct and cannot be challenged
   • CFixing a design flaw during the testing phase would require rework of the code, architecture, and tests, which is significantly more expensive and time-consuming
   • DThe project manager does not have the authority to make this decision
   Reveal Solution Discussion Select an answer first