Security Testing CTAL-TTA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A software development team is building a document management system that will store sensitive legal documents. The system uses role-based access control (RBAC) and encrypts documents at rest. The security test team needs to design test cases for the encryption mechanism. Which of the following test cases would MOST effectively verify the confidentiality of the documents?

   • AConfirm that the application uses HTTPS for all network communications
   • BAttempt to read the encrypted files directly from the storage medium without using the application
   • CCheck that the encryption keys are stored in a hardware security module (HSM)
   • DVerify that the RBAC roles are correctly assigned to users
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a primary reason for conducting security testing?

   • ATo increase the speed of the application
   • BTo reduce the risk of security breaches
   • CTo improve the user interface design
   • DTo reduce the cost of development
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of security test verifies that a user is who they claim to be?

   • AAuthentication testing
   • BEncryption testing
   • CAuthorization testing
   • DAvailability testing
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's web application allows users to reset their passwords by answering security questions. The security test team is designing test cases for the password reset mechanism. Which of the following test cases would MOST effectively verify the security of the password reset process?

   • AAttempting to reset a password using a security question answer that is common knowledge, such as a pet's name
   • BConfirming that the password reset page is accessible over HTTPS
   • CVerifying that the password reset email is sent to the user's registered email address
   • DChecking that the password reset link expires after a certain time
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A multinational corporation is implementing a new HR system that will store employee personal data, including salaries and health information. The system will be hosted in a public cloud. The company must comply with GDPR, which requires that personal data be protected. The security team is planning security testing. Which of the following is the MOST critical consideration for the security test plan?

   • ATesting the application's user interface for usability and accessibility
   • BEnsuring that the cloud provider's data center is located in a specific country to meet data residency requirements
   • CVerifying that the cloud provider's servers are physically secured with biometric access controls
   • DConfirming that the cloud provider's billing system is accurate
   Reveal Solution Discussion Select an answer first