System Testing and Acceptance Testing CT-STE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security test engineer is planning acceptance tests for a new cross-border payment system. The stakeholders include the compliance department, which requires that all personal data of EU citizens be stored in the EU, and the operations team, which wants to use a cost-effective cloud provider that has data centers in multiple regions. The engineer must define acceptance criteria that satisfy both stakeholders. Which of the following is the most appropriate acceptance criterion?

   • AThe system must use a private cloud, which guarantees data residency.
   • BThe system must be able to store data in any region, and the compliance department must accept this.
   • CAll personal data of EU citizens must be stored in an EU data center, and the system must demonstrate this during acceptance testing.
   • DThe system must use the cheapest cloud provider available, regardless of data location.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key consideration when evaluating acceptance security test results?

   • AThe user's satisfaction with the system
   • BThe number of security defects found
   • CWhether the system meets the agreed acceptance criteria
   • DThe performance of individual components
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security test engineer is executing acceptance tests for a new customer relationship management (CRM) system. The acceptance criteria include that all user access must be logged and that the logs must be tamper-proof. The engineer has executed the tests and the logs are being generated correctly. What is the next step in the acceptance testing process?

   • ABegin system testing to verify the integrated system's behavior.
   • BDeploy the system to production immediately.
   • CObtain formal sign-off from the stakeholders that the acceptance criteria have been met.
   • DDocument the test results and archive them for future reference.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security test engineer is assigned to test a newly integrated e-commerce platform. The platform consists of a web front-end, a REST API, a payment gateway integration, and a customer database. The engineer needs to verify that the system as a whole correctly enforces access control when a user attempts to view another user's order history. Which type of testing is most appropriate for this scenario?

   • AUnit testing, because it isolates the access control logic in a single module.
   • BRegression testing, because it ensures that previous functionality still works after changes.
   • CAcceptance testing, because it validates that the system meets stakeholder expectations.
   • DSystem testing, because it verifies end-to-end behavior across integrated components.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security test engineer is planning acceptance tests for a new financial trading platform. The stakeholders include the compliance department, the risk management team, and the IT operations team. The engineer needs to define acceptance criteria and involve stakeholders in the test design. Which of the following is the most effective approach for planning these acceptance security tests?

   • ADefine acceptance criteria based solely on the technical team's understanding of security.
   • BHold workshops with stakeholders to define measurable security acceptance criteria and review test cases.
   • CUse a standard set of security test cases from a generic checklist.
   • DWait until the system is fully developed before planning acceptance tests.
   Reveal Solution Discussion Select an answer first