The Concept of OSS and Its Impacts on Security Testing CT-STE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security test manager is creating a checklist for reviewing open-source components before they are approved for use in a project. Which item should be included in the checklist?

   • AVerify the component's license and ensure it is compatible with the project's distribution model.
   • BCheck that the component's documentation is comprehensive.
   • CEnsure the component is written in the same programming language as the project.
   • DConfirm that the component has a large number of stars on GitHub.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security tester is reviewing a software product that includes a component licensed under the GNU General Public License (GPL). The product is distributed as a proprietary, closed-source application. What is the primary security testing implication of this licensing situation?

   • AThe tester must ensure the product's source code is made available to comply with the GPL, which may affect the testing scope.
   • BThe tester must verify that the GPL component is up-to-date and patched, as GPL licenses require regular security updates.
   • CThe tester should focus on the GPL component's known vulnerabilities, as proprietary components are inherently secure.
   • DThe tester can ignore the license because security testing is independent of licensing.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security test manager is planning the testing strategy for a product that includes several open-source components. The product will be released to customers. What should be included in the security testing plan?

   • AA focus only on the application's custom code, as OSS components are already tested.
   • BA review of the OSS components' documentation to ensure they are user-friendly.
   • CA plan to replace all OSS components with proprietary alternatives to avoid security risks.
   • DA process to inventory all OSS components and check for known vulnerabilities and license compliance.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is evaluating whether to use a popular open-source authentication library. They have access to the source code and a public issue tracker. How can the team best leverage the open-source nature to enhance their security testing?

   • ARely solely on the community's bug reports without conducting independent testing.
   • BPerform a static analysis of the source code and review public vulnerability reports and fixes.
   • COnly test the library's external interfaces, as the internal code is not relevant.
   • DAssume the library is secure because many organizations use it.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security test manager is developing a testing strategy for a product that uses many open-source components. The product has a tight budget and timeline. What is the most effective way to prioritize security testing of these components?

   • ATest only the components that are newly added.
   • BPrioritize components that are critical to the product's functionality and have a history of vulnerabilities.
   • CTest only the components that are most popular.
   • DTest all components equally, regardless of their risk.
   Reveal Solution Discussion Select an answer first