ISTQB Certified Tester Security Tester (CT-SEC)

Scenario:

You are a member of a test team that is responsible for performing system testing and supporting user acceptance testing. The application being tested has reached the exit criteria in both test levels. The application has been deployed in the pre-production environment, where it has been observed that the database administrator is unable to access the database objects.

Question:

In the above scenario, which ONE of the following attributes of the test environment is missing?

Sophie is analyzing the security requirements of user stories to ensure that the security-related aspects of the users' needs have been adequately covered. She is also defining the most workable approach to develop the application in a secure way.

In which stage of the software development life cycle should this activity be performed?

Which ONE of the following security vulnerabilities can be identified through structural testing during component testing?

Scenario:

At “Happy Wrench Plumbing”, an administrator (admin) manages clients and other users and is able to edit their personal details in the application by accessing the URL: http://www.abcxyz.com/editusers.

It is necessary to test if non-admin users can perform this above-mentioned functionality.

Question:

Which ONE of the following options CORRECTLY corresponds to the security testing type that is necessary to achieve this goal?

Annie is creating a fake email id to present herself as the CTO of a company. She is also using social media, instant messaging, and SMS to trick some potential victims into providing sensitive information.

Which ONE of the following attacks is she planning?

Scenario:

An international health insurance company has an advanced management system for its services that can be accessed by different types of stakeholders.

As a consequence of a deficiency in the security requirements for a new module, a data access monitoring process has not been implemented for the stakeholders involved in customer management. This feature implies that, every time any corporate stakeholder accesses a customer’s data, a record must be kept identifying the user, date and time of access as well as the reason(s) for accessing this data.

Question:

Based on the above scenario, which TWO aspects associated with the requirements could be impacted by the implementation of the solution? (Choose two.)

Background:

CAPTCHA stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart. A CAPTCHA is a program that protects websites against bots by generating and grading tests that humans can pass but current computer programs cannot. For example, humans can read distorted text, but current computer programs cannot.

Scenario:

A web application available for mobile devices provides value-added services upon free registration of future users. This application provides a series of free and other paid services. The project’s security manager has proposed to include a CAPTCHA during the registration process.

Question:

Which ONE of the following objectives of security tests for this feature is CORRECT?

A firewall has been implemented so that communications can be filtered according to users being the connections and data according to pattern descriptions.

What type of access restriction product or mechanism is described above?

George is a security tester who is using a suite of tools to perform different tasks, such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. He aims to determine the hosts available on the network, services and OS versions they are running, what type of packet filters and/or firewalls are in use and also to make a list of string parameters like ‘ or “, -- or #, /*…*/, +, ||, %, PRINT.

Which TWO of the following types of testing is George performing? (Choose two.)