System Testing and Acceptance Testing CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security test engineer is executing system-level security tests for a new online gaming platform. The platform includes a game server, a matchmaking service, and a user profile database. The engineer needs to verify that the system can prevent a distributed denial-of-service (DDoS) attack on the game server while maintaining the ability for legitimate players to connect. Which of the following is the most appropriate approach for this system-level security test?

   • ASimulate a DDoS attack on the game server and verify that legitimate players can still connect and play.
   • BVerify that the user profile database is protected by a firewall.
   • CReview the game server's network configuration for DDoS protection settings.
   • DTest the matchmaking service in isolation to see if it can handle a DDoS attack.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When planning system security tests, what should be defined to ensure the tests are effective?

   • AThe individual unit test cases for each component
   • BThe scope, environment, and test data for the integrated system
   • CThe user training materials for the system
   • DThe acceptance criteria and stakeholder sign-off procedures
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a key aspect of planning acceptance security tests?

   • ADefining acceptance criteria and involving stakeholders in test design
   • BSelecting the test data for unit testing
   • CIdentifying the specific security vulnerabilities to exploit
   • DDefining the scope of the integrated system test environment
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What does system testing aim to assess regarding the system's security?

   • AThe system's resilience to attacks in a complete, integrated environment
   • BThe acceptance of security controls by end users
   • CThe compliance of the system with legal regulations
   • DThe performance of individual security algorithms
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security test engineer is executing system-level security tests for a new online retail platform. The platform includes a web application, a payment processing service, and a customer database. The engineer needs to verify that the system correctly handles a malicious input that could cause a SQL injection attack. Which of the following is the most appropriate action during system-level security testing?

   • AReview the source code of the database access layer for SQL injection vulnerabilities.
   • BSend malicious SQL payloads through the web application's input fields and observe the system's response.
   • CVerify that the web application's firewall blocks all SQL injection attempts.
   • DTest the database directly with SQL injection payloads, bypassing the application.
   Reveal Solution Discussion Select an answer first