Test Oracles Extracted from Standards and Best Practices CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security tester is evaluating a web application that must comply with both PCI DSS and ISO/IEC 27001. The tester finds that the application uses a single sign-on (SSO) solution that does not log individual user actions. PCI DSS requires logging of all access to cardholder data, while ISO/IEC 27001 requires logging of user activities. The SSO solution is a third-party service that cannot be modified. What should the tester do?

   • AAccept the risk because the SSO solution is a third-party service and cannot be modified.
   • BReport the gap and recommend that the application implement its own logging for security-relevant actions.
   • CIgnore the ISO/IEC 27001 requirement because PCI DSS is the more important standard.
   • DRecommend that the organization switch to a different SSO provider that supports logging.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security tester is designing tests for a web application that handles personal data. The tester has two candidate oracles: one from a mandatory data protection regulation and one from a widely accepted industry best practice. The regulation is broad and does not specify technical controls, while the best practice provides detailed technical requirements. The organization must comply with the regulation. What is the most effective approach?

   • AUse the best practice to derive specific test cases, and use the regulation to define the overall compliance objectives.
   • BUse only the regulation as the oracle because it is mandatory and the best practice is voluntary.
   • CUse only the best practice as the oracle because it provides specific technical requirements.
   • DUse the regulation for the test plan and the best practice for the test report, but not for test design.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is evaluating a web application that processes credit card transactions. The tester needs to verify that the application does not store sensitive authentication data after authorization. Which standard-derived oracle should the tester use to define the expected behavior?

   • AOWASP ASVS V2.1, which requires that all authentication credentials be protected using strong, adaptive hashing algorithms.
   • BISO/IEC 27001 Annex A.9.4.2, which mandates secure log-on procedures for all system users.
   • CPCI DSS requirement 3.2, which states that sensitive authentication data must not be stored after authorization, even if encrypted.
   • DNIST SP 800-63B, which requires multi-factor authentication for all privileged accounts.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security tester is assessing a web application against OWASP ASVS. The tester is at Level 1 and is verifying that the application does not expose sensitive data in URLs. Which ASVS control should the tester use as the oracle?

   • AV8.1.1, which requires that the application logs all security-relevant events.
   • BV6.1.1, which requires that all sensitive data is encrypted in transit using TLS.
   • CV3.1.1, which requires that sensitive data is not sent in URLs or embedded in HTTP headers.
   • DV4.1.1, which requires that all access control decisions are enforced on the server side.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security tester is verifying that a web application uses strong cryptography for storing passwords. Which OWASP ASVS control should the tester use as the oracle?

   • AV3.1.1, which requires that sensitive data not be sent in URLs.
   • BV8.1.1, which requires that all security-relevant events be logged.
   • CV4.1.1, which requires that all access control decisions be enforced on the server side.
   • DV2.1.1, which requires that all authentication credentials be protected using strong, adaptive hashing algorithms.
   Reveal Solution Discussion Select an answer first