Test Oracles Extracted from Standards and Best Practices CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security tester is reviewing a new API that allows clients to query user profiles. The tester wants to ensure that the API does not expose more data than necessary. Which best-practice-derived oracle should the tester apply?

   • AThe API must require authentication using OAuth 2.0 tokens.
   • BThe API must return only the fields that are explicitly requested by the client, using a mechanism like field selection or sparse fieldsets.
   • CThe API must log all requests and responses for audit purposes.
   • DThe API must use HTTPS to encrypt all communications.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a test oracle that could be extracted from PCI DSS for a system that handles credit card data?

   • AAll employees must use two-factor authentication
   • BThe system must undergo penetration testing every year
   • CThe system must be hosted in a specific cloud provider
   • DCardholder data must be encrypted when stored
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a test oracle derived from secure coding best practices?

   • AThe system must be tested only by automated tools
   • BUser input must be validated and sanitized before being processed
   • CThe system must have no error messages
   • DThe code must be written in a specific programming language
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement best describes how best practices function as test oracles in security testing?

   • AThey are only useful for compliance audits, not for test design
   • BThey are legally binding requirements that must be followed exactly
   • CThey provide a set of expected security behaviors that are widely accepted as good practice, against which the system can be assessed
   • DThey are specific to a single technology and cannot be generalized
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In security testing, what is the primary role of a standard such as ISO/IEC 27001 when used as a test oracle?

   • ATo guarantee that a system is secure if all standard requirements are met
   • BTo serve as an authoritative source for expected security behavior against which test results can be compared
   • CTo replace the need for test design and test execution
   • DTo provide a definitive list of all possible vulnerabilities in a system
   Reveal Solution Discussion Select an answer first