Quiz
Secure Software Testing
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (30)
1Testing without knowledge of the inner workings of a system is called:
- APen Testing
- BWhite-box Testing
- CBlack-box Testing
- DVulnerability Scanning
2OSSTMM is used for:
- AAssessing operational security using analytical metrics
- BSecurity Engineering
- CQuality assurance for software
- DEvaluating security engineering practices
3Functional testing includes all of the following except:
- ASystem testing
- BAttack surface testing
- CUnit testing
- DPerformance testing
4Functional testing is used to determine which of the following characteristics?
- AReliability, bugs, performance, scalability
- BResiliency, logic, security, testability
- CResiliency, bugs, requirements, and scalability
- DReliability, logic, performance, scalability
5The ability of an application to restore itself to expected functionality after the security protection is breached or bypassed is called:
- AResilience
- BRecoverability
- CReliability
- DRestoration
6When testing is done with complete knowledge of the source code, it is called:
- AUnit testing
- BFunctional testing
- CWhite-box testing
- DCode walkthrough
7What type of testing used to assess software behaviour albeit with significant false-positive results because of no system knowledge?
- AOSSTMM testing
- BEnvironmental testing
- CTrust boundary testing
- DBlack-box testing
8A list of the types of errors that are not allowed to go forward as part of the SDL process is called a(n):
- ABug bar
- BAttack surface validation
- CSecurity requirements
- DSDL security gate
9An operational measure of what constitutes the minimum level of quality with respect to security in code is a description of:
- AISO 9216 process element
- BOSSTMM report
- CBug bar
- DSDL process requirement
10Defect tracking is important for all of the following reasons except:
- ASDL process-based improvement metric over time.
- BManage programmer workload
- CApplication code quality metric
- DEnsure all defects are eventually addressable
11The following elements are part of performance testing except:
- APenetration testing
- BSLA achievement testing
- CStress testing
- DLoad testing
12Environmental testing can be used to:
- ATest data movement across trust boundaries from end to end of the application
- BEnsure the code will run in the cloud
- CEnsure code compiles completely
- DVerifying mutual authentication functions in the applications
13Functional testing steps include:
- ARequirements, test data creation, expected output results, execute test cases, comparison of actual and expected outputs
- BCreate test data, perform functional test, score output
- CRequirements, create test data, perform functional test
- DRequirements, perform functional test, score output
14An international standard for establishing quality in software products is:
- AISO 9000
- BISO 27001
- CISO 21827
- DISO 9216
15The objective of tracking bugs is to:
- ADetermine the source of bugs
- BEnsure that they get addressed by the development team
- CTrack where bugs are originating in software
- DScore developers' coding ability
16Which criteria should be used to determine the priority for corrective action of a bug in an application?
- AEase of correction effort (fix easy ones fast)
- BCost to repair bugs
- CPotential system impact of the bug
- DSize of the bug in line of code affected
17Testing different versions of an application to verify patches don't break something is referred to as:
- APenetration testing
- BSimulation testing
- CFuzz testing
- DRegression testing
18Testing an application in an environment that mirrors the production environment is referred to as:
- ASimulation testing
- BFuzz testing
- CScanning
- DPenetration testing
19Verification of cryptographic functions include all of the following except:
- AUse of secret encryption methods
- BKey distribution
- CCryptographic algorithm
- DProper random number generation
20An automated enumeration of specific characteristics of an application or network is referred to as:
- APenetration testing
- BScanning
- CFuzz testing
- DSimulation testing
21To examine a system for input validation errors, the most comprehensive test is:
- AScanning
- BPenetration testing
- CRegression testing
- DFuzz testing
22Fuzz testing data can be characterized by:
- AMutation or generation
- BInput validation, file, or network parsing
- CSize and character set
- DType of fault being tested for
23Penetration testing includes the following steps:
- AReconnaissance, testing, reporting
- BReconnaissance, exploitation, recovery
- CAttacking, testing, recovery
- DReconnaissance, attacking, removal of evidence, reporting
24Characterizing an application in the environment it is designed to operate in can be done with:
- AScanning
- BFailure testing
- CSimulation testing
- DPen testing
25FIPS 140-2 is a federal standard associated with:
- ASoftware quality assurance
- BSecurity testing
- CCryptographic implementation in software
- DSoftware security standards
26One of the challenges associated with regression testing is:
- ADetermining an appropriate test portfolio
- BDetermining when to employ it
- CThe skill level needed to perform it
- DDesigning an operational platform for testing
27To test a system for problems such as configuration errors or data issues, one would use:
- AScanning
- BConfiguration testing
- CTesting for failure
- DSimulation testing
28Regression testing is employed across:
- ADifferent modules based on fuzz testing results
- BDifferent versions after patching has been employed
- CCryptographic modules to test stability
- DThe production environment
29The following are causes of cryptographic failure except:
- AChoice of algorithm
- BRandom number generation
- CKey length
- DSecret data management
30Sending multitudes of input to a program during testing is called:
- ARegression testing
- BScanning
- CSimulation testing
- DFuzz testing
Informações
- Descrição
- Quiz sobre Secure Software Testing, criado por Ashton Norton em 13-03-2017.
- Autor
- Ashton Norton
- Idioma
- English
- Visualizações
- 1
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz