CSLLP Secure Software Testing

Question 1

Which testing methodology tests software from the outside without knowledge of the internal code or architecture?

Accepted Answer

Black-box testing

Answer

Black-box testing simulates an external attacker's perspective, probing the application through its interfaces without access to source code, design documents, or internal logic.

Question 2

What is the primary goal of penetration testing?

Accepted Answer

To actively exploit vulnerabilities in a controlled manner to assess the real-world impact of security weaknesses

Answer

Penetration testing simulates real attack scenarios to discover and demonstrate the exploitability of vulnerabilities and their potential business impact.

Question 3

Dynamic Application Security Testing (DAST) differs from SAST because it:

Accepted Answer

Tests the running application by sending inputs and observing responses

Answer

DAST tests a running application from the outside, sending crafted requests to find vulnerabilities such as injection flaws, authentication weaknesses, and misconfigurations.

Question 4

What does 'test coverage' measure in software security testing?

Accepted Answer

The proportion of code paths, branches, or requirements exercised by the test suite

Answer

Test coverage metrics quantify how much of the application's code or functionality is exercised by tests, helping identify untested areas that may contain hidden vulnerabilities.

Question 5

Which testing technique systematically explores all possible input values and states to find edge cases that trigger security flaws?

Accepted Answer

Boundary value analysis

Answer

Boundary value analysis tests inputs at and around the boundaries of valid ranges, since off-by-one errors and buffer overflows often occur at these edges.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Testing