Test Oracles Extracted from Standards and Best Practices CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In security testing, how do standards and best practices complement each other as test oracles?

   • AStandards are used only for compliance audits, while best practices are used only for penetration testing
   • BBest practices are more important than standards because they are always up-to-date
   • CStandards provide a baseline of required controls, while best practices offer additional recommendations to strengthen security
   • DStandards and best practices are interchangeable and can be used in the same way
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security tester is reviewing a web application that uses a third-party library for file uploads. The library is known to have a vulnerability that allows arbitrary file upload. The tester wants to verify that the application mitigates this risk. Which best-practice-derived oracle should the tester apply?

   • AThe application must restrict uploads to authenticated users only.
   • BThe application must update the third-party library to the latest version.
   • CThe application must validate the file type and content, and store files outside the web root.
   • DThe application must log all upload attempts for audit purposes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester is verifying that a web application does not store the card verification code (CVV) after authorization. Which PCI DSS requirement should the tester use as the oracle?

   • ARequirement 3.2.1, which prohibits storing the full magnetic stripe data.
   • BRequirement 3.2.2, which prohibits storing the card verification code or value.
   • CRequirement 3.4, which requires rendering PAN unreadable when stored.
   • DRequirement 3.3, which requires masking the PAN when displayed.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does a standards-based oracle help in evaluating the security posture of a system under test?

   • ABy eliminating the need for manual testing
   • BBy providing a specific expected security control that the system must implement, which the tester verifies
   • CBy automatically fixing any security vulnerabilities found during testing
   • DBy providing a list of all possible attack vectors
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A tester is using industry guidelines as a source of test oracles. Which of the following is a test oracle that could be derived from the principle of least privilege?

   • AUsers should only have the minimum permissions necessary to perform their tasks
   • BAll users should have administrative access to the system
   • CPasswords should be changed every 90 days
   • DUsers should be able to access all data without restrictions
   Reveal Solution Discussion Select an answer first