Test Oracles Extracted from Standards and Best Practices CT-STE Practice Questions (Page 5)

Questions 21–21

1. 21expert · hard

   A security tester is designing a test for a web application that handles sensitive data. The tester has two oracles: one from a mandatory standard that requires encryption of data at rest, and one from a best practice that recommends using a specific encryption algorithm. The mandatory standard does not specify the algorithm. What is the best way to use these oracles?

   • AUse the mandatory standard to define the requirement (encryption at rest) and the best practice to define the technical implementation (specific algorithm).
   • BUse only the best practice because it provides more specific technical details.
   • CUse only the mandatory standard because it is the only one that is required.
   • DUse the best practice to define the requirement and the mandatory standard to define the implementation.
   Reveal Solution Discussion Select an answer first