Sequential Development Models CT-STE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the goal of security functional testing?

   • ATo review the system's architecture for security flaws
   • BTo identify all possible vulnerabilities in the system
   • CTo measure the system's performance under attack
   • DTo verify that security features work as specified
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A development team is in the implementation phase of a Waterfall project. They have just finished writing the authentication module. The security tester wants to identify common coding flaws such as SQL injection and buffer overflows before the code is integrated. Which technique is most appropriate?

   • AStatic application security testing (SAST) and a manual code review
   • BA full penetration test of the production environment
   • CDynamic application security testing (DAST) against the integrated build
   • DA post-incident review of the last security breach
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A developer has just finished writing a module that handles file uploads. The security tester is concerned about path traversal and malicious file uploads. The project is in the implementation phase of a V-model. Which combination of activities is most appropriate to verify this module's security?

   • AA manual code review focused on input validation and a static analysis scan of the module
   • BA security requirements review with the business owner
   • CA threat model of the entire system architecture
   • DA dynamic scan of the entire application and a penetration test
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the V-model, which activity is directly paired with the requirements analysis phase?

   • ASystem testing
   • BIntegration testing
   • CUnit testing
   • DAcceptance testing
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During the design phase of a Waterfall project, the security team is reviewing the architecture of a new e-commerce platform. They have identified that the session management design is flawed and could allow session fixation attacks. What is the most appropriate action at this stage?

   • AProceed to implementation and fix the flaw during the testing phase
   • BIgnore the flaw because it is a low-risk issue
   • CDocument the flaw and require the design to be revised before implementation begins
   • DImmediately write a penetration test to verify the flaw in production
   Reveal Solution Discussion Select an answer first