Security Testing CTAL-TTA Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A healthcare organization stores patient records in a database that is accessed by a web application. The organization must comply with GDPR, which requires that personal data be protected against unauthorized access. During a security test planning meeting, the team identifies that the database is accessible from the internal network without any additional authentication beyond the application login. Which of the following is the MOST important reason to include a security test that attempts to access the database directly, bypassing the application?

   • ATo confirm that the database is available for authorized users during peak load
   • BTo validate that the application's login page uses strong password policies
   • CTo verify that the database enforces confidentiality by preventing unauthorized direct access
   • DTo ensure that the database schema is normalized and follows best practices
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A software company is developing a new customer relationship management (CRM) system that will store customer contact information. The system will be accessible over the internet. The security test team is planning the security testing approach. Which of the following techniques should be included in the security test plan to identify vulnerabilities in the system's input handling?

   • ARegression testing to ensure existing features still work
   • BUsability testing with real users
   • CLoad testing to simulate high user traffic
   • DFuzz testing with malformed input data
   Reveal Solution Discussion Select an answer first