CASE Quality Assurance & Compliance 4

Question 1

A compliance officer finds that a vendor's application logs contain plaintext passwords. Under GDPR, which principle is most directly violated?

Accepted Answer

Integrity and confidentiality

Answer

GDPR Article 5(1)(f) requires personal data to be processed with appropriate security, including protection against unauthorized access — plaintext passwords directly violate this integrity and confidentiality principle.

Question 2

Which testing technique is most effective at identifying insecure deserialization vulnerabilities during QA?

Accepted Answer

Sending crafted serialized payloads to application endpoints

Answer

Insecure deserialization is best detected by crafting malicious serialized objects and observing whether the application executes unintended code or crashes.

Question 3

In a CASE exam scenario, a tester identifies that an application stores session tokens in localStorage. Why is this a security quality concern?

Accepted Answer

JavaScript can access localStorage, making tokens vulnerable to XSS theft

Answer

Storing session tokens in localStorage exposes them to any JavaScript executing in the same origin, including malicious scripts injected via XSS.

Question 4

Which compliance framework introduced the concept of 'Secure Software Development Framework (SSDF)' as a formal guidance document?

Accepted Answer

NIST (via SP 800-218)

Answer

NIST SP 800-218 defines the Secure Software Development Framework (SSDF), providing a set of fundamental, sound, and secure software development practices.

Question 5

During a post-release security review, you find a critical vulnerability that was present in a previous version and should have been caught by regression testing. What process improvement should you recommend?

Accepted Answer

Add a test case for this vulnerability class to the automated regression suite

Answer

Adding an automated regression test case for the specific vulnerability class ensures the same flaw type is detected in all future builds.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Quality Assurance & Compliance 4