CSLLP Secure Software Testing 2 — Questions and Answers
Question 1: What does IAST (Interactive Application Security Testing) combine?
- Manual code review and automated scanning
- Elements of SAST and DAST by instrumenting the application and monitoring it during runtime testing (Correct answer)
- Network scanning and host-based vulnerability assessment
- Threat modeling and penetration testing
Correct answer: Elements of SAST and DAST by instrumenting the application and monitoring it during runtime testing
IAST uses agents or instrumentation within the running application to detect vulnerabilities in real time as the application is exercised, combining the context of SAST with the runtime behavior of DAST.
Question 2: A test that verifies the application correctly enforces access restrictions (e.g., a regular user cannot access admin functions) is called:
- Functional testing
- Authorization testing (Correct answer)
- Authentication testing
- Availability testing
Correct answer: Authorization testing
Authorization testing specifically checks that the application enforces proper access controls, ensuring users can only access resources and perform actions they are permitted to.
Question 3: Which document formally authorizes a system to operate in a production environment after security testing and risk acceptance?
- Security test plan
- Authorization to Operate (ATO) (Correct answer)
- Risk assessment report
- System security plan (SSP)
Correct answer: Authorization to Operate (ATO)
An ATO is the formal management decision granting authority for a federal information system to operate, based on assessment of implemented security controls and residual risk.
Question 4: What type of security test deliberately overloads a system with requests to determine its breaking point?
- Penetration test
- Stress test / DoS resilience test (Correct answer)
- Fuzz test
- Regression test
Correct answer: Stress test / DoS resilience test
Stress testing pushes the system beyond normal operational capacity to find the point of failure, helping identify DoS vulnerabilities and ensuring graceful degradation under overload.
Question 5: Which methodology would a security tester use to verify that a web application properly validates session tokens and prevents session hijacking?
- Load testing
- Session management testing (Correct answer)
- Code coverage analysis
- Static code analysis
Correct answer: Session management testing
Session management testing evaluates the strength and handling of session tokens, checking for predictable IDs, improper expiration, missing secure and HttpOnly cookie flags, and hijacking vulnerabilities.
Question 6: What is the primary purpose of a vulnerability scan in software security testing?
- To actively exploit discovered vulnerabilities
- To automatically identify known vulnerabilities and misconfigurations in systems and applications (Correct answer)
- To review source code for security defects
- To simulate an insider threat scenario
Correct answer: To automatically identify known vulnerabilities and misconfigurations in systems and applications
Vulnerability scanning uses automated tools to identify known vulnerabilities (CVEs), missing patches, and misconfigurations without exploiting them, providing a broad view of the attack surface.
CSLLP Secure Software Testing 2
What does IAST (Interactive Application Security Testing) combine?