Quiz
Secure Software Testing
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (30)
1Testing without knowledge of the inner workings of a system is called:
- APen Testing
- BWhite-box Testing
- CBlack-box Testing
- DVulnerability Scanning
2OSSTMM is used for:
- AAssessing operational security using analytical metrics
- BSecurity Engineering
- CQuality assurance for software
- DEvaluating security engineering practices
3Functional testing includes all of the following except:
- ASystem testing
- BAttack surface testing
- CUnit testing
- DPerformance testing
4Functional testing is used to determine which of the following characteristics?
- AReliability, bugs, performance, scalability
- BResiliency, logic, security, testability
- CResiliency, bugs, requirements, and scalability
- DReliability, logic, performance, scalability
5The ability of an application to restore itself to expected functionality after the security protection is breached or bypassed is called:
- AResilience
- BRecoverability
- CReliability
- DRestoration
6When testing is done with complete knowledge of the source code, it is called:
- AUnit testing
- BFunctional testing
- CWhite-box testing
- DCode walkthrough
7What type of testing used to assess software behaviour albeit with significant false-positive results because of no system knowledge?
- AOSSTMM testing
- BEnvironmental testing
- CTrust boundary testing
- DBlack-box testing
8A list of the types of errors that are not allowed to go forward as part of the SDL process is called a(n):
- ABug bar
- BAttack surface validation
- CSecurity requirements
- DSDL security gate
9An operational measure of what constitutes the minimum level of quality with respect to security in code is a description of:
- AISO 9216 process element
- BOSSTMM report
- CBug bar
- DSDL process requirement
10Defect tracking is important for all of the following reasons except:
- ASDL process-based improvement metric over time.
- BManage programmer workload
- CApplication code quality metric
- DEnsure all defects are eventually addressable
11The following elements are part of performance testing except:
- APenetration testing
- BSLA achievement testing
- CStress testing
- DLoad testing
12Environmental testing can be used to:
- ATest data movement across trust boundaries from end to end of the application
- BEnsure the code will run in the cloud
- CEnsure code compiles completely
- DVerifying mutual authentication functions in the applications
13Functional testing steps include:
- ARequirements, test data creation, expected output results, execute test cases, comparison of actual and expected outputs
- BCreate test data, perform functional test, score output
- CRequirements, create test data, perform functional test
- DRequirements, perform functional test, score output
14An international standard for establishing quality in software products is:
- AISO 9000
- BISO 27001
- CISO 21827
- DISO 9216
15The objective of tracking bugs is to:
- ADetermine the source of bugs
- BEnsure that they get addressed by the development team
- CTrack where bugs are originating in software
- DScore developers' coding ability
16Which criteria should be used to determine the priority for corrective action of a bug in an application?
- AEase of correction effort (fix easy ones fast)
- BCost to repair bugs
- CPotential system impact of the bug
- DSize of the bug in line of code affected
17Testing different versions of an application to verify patches don't break something is referred to as:
- APenetration testing
- BSimulation testing
- CFuzz testing
- DRegression testing
18Testing an application in an environment that mirrors the production environment is referred to as:
- ASimulation testing
- BFuzz testing
- CScanning
- DPenetration testing
19Verification of cryptographic functions include all of the following except:
- AUse of secret encryption methods
- BKey distribution
- CCryptographic algorithm
- DProper random number generation
20An automated enumeration of specific characteristics of an application or network is referred to as:
- APenetration testing
- BScanning
- CFuzz testing
- DSimulation testing
21To examine a system for input validation errors, the most comprehensive test is:
- AScanning
- BPenetration testing
- CRegression testing
- DFuzz testing
22Fuzz testing data can be characterized by:
- AMutation or generation
- BInput validation, file, or network parsing
- CSize and character set
- DType of fault being tested for
23Penetration testing includes the following steps:
- AReconnaissance, testing, reporting
- BReconnaissance, exploitation, recovery
- CAttacking, testing, recovery
- DReconnaissance, attacking, removal of evidence, reporting
24Characterizing an application in the environment it is designed to operate in can be done with:
- AScanning
- BFailure testing
- CSimulation testing
- DPen testing
25FIPS 140-2 is a federal standard associated with:
- ASoftware quality assurance
- BSecurity testing
- CCryptographic implementation in software
- DSoftware security standards
26One of the challenges associated with regression testing is:
- ADetermining an appropriate test portfolio
- BDetermining when to employ it
- CThe skill level needed to perform it
- DDesigning an operational platform for testing
27To test a system for problems such as configuration errors or data issues, one would use:
- AScanning
- BConfiguration testing
- CTesting for failure
- DSimulation testing
28Regression testing is employed across:
- ADifferent modules based on fuzz testing results
- BDifferent versions after patching has been employed
- CCryptographic modules to test stability
- DThe production environment
29The following are causes of cryptographic failure except:
- AChoice of algorithm
- BRandom number generation
- CKey length
- DSecret data management
30Sending multitudes of input to a program during testing is called:
- ARegression testing
- BScanning
- CSimulation testing
- DFuzz testing
Information
- Description
- Quiz on Secure Software Testing, created by Ashton Norton on 13/03/2017.
- Author
- Ashton Norton
- Language
- English
- Views
- 1
- Tags
- Rating
- No ratings yet Rate this quiz