Software Engineering Assessment 5 — Questions and Answers
Question 1: A security assessment finds that user input is directly concatenated into SQL queries. Which vulnerability class does this represent?
- SQL injection (Correct answer)
- Cross-site scripting (XSS)
- Insecure deserialization
- Broken authentication
Correct answer: SQL injection
Concatenating unsanitized user input into SQL queries allows attackers to manipulate the query structure, a classic SQL injection vulnerability.
Question 2: Which performance assessment test determines how a system behaves when subjected to loads beyond its normal operating capacity?
- Stress testing (Correct answer)
- Load testing
- Soak testing
- Smoke testing
Correct answer: Stress testing
Stress testing pushes the system beyond its capacity limits to identify breaking points and observe failure behavior.
Question 3: A maturity assessment using the Test Maturity Model Integration (TMMi) evaluates which aspect of software engineering?
- The organization's testing process capability (Correct answer)
- The coverage of automated unit tests
- The correctness of individual test cases
- The speed of the CI pipeline
Correct answer: The organization's testing process capability
TMMi assesses and guides improvement of an organization's testing processes across five maturity levels.
Question 4: In an agile retrospective used as a team assessment tool, the 'What went well / What to improve' format primarily aims to assess which dimension?
- Team process and collaboration effectiveness (Correct answer)
- Individual developer skill gaps
- Product feature completeness
- Customer satisfaction scores
Correct answer: Team process and collaboration effectiveness
Retrospectives assess team dynamics and process health to identify actionable improvements for the next iteration.
Question 5: During a software assessment, 'escapee defects' refer to defects that are identified at which point?
- After the software is released to production (Correct answer)
- During unit testing
- During the design review phase
- Before code is written
Correct answer: After the software is released to production
Escapee defects (or escaped defects) are those that slip through all testing phases and are discovered only after release.
Question 6: Which technique used in security assessment involves simulating an attacker's perspective to identify vulnerabilities in a system?
- Penetration testing (Correct answer)
- Fuzz testing
- Boundary value analysis
- Equivalence partitioning
Correct answer: Penetration testing
Penetration testing (pen testing) mimics real-world attacks to discover exploitable security weaknesses before malicious actors do.
Question 7: An assessment reveals that a microservices architecture has created excessive inter-service dependencies, slowing deployments. This is an example of which anti-pattern?
- Distributed monolith (Correct answer)
- Spaghetti code
- Big Ball of Mud
- Strangler Fig pattern
Correct answer: Distributed monolith
A distributed monolith occurs when microservices are so tightly coupled they cannot be deployed independently, negating the architecture's benefits.
Software Engineering Assessment 5
A security assessment finds that user input is directly concatenated into SQL queries.
Which vulnerability class does this represent?