CISSP: Certified Information Systems Security Professional

Question

An application developer receives a report from the security team indicating that its automated tools successfully submitted unexpected data to the organization’s customer service portal, causing the site to crash. This is an example of which testing type?

Explanation

Negative testing evaluates how an application responds to invalid, malformed, or otherwise unexpected input. A crash after accepting unexpected data shows that the application did not safely handle an invalid-input condition. OWASP security testing guidance describes testing with unexpected data and edge cases to identify improper error handling and unhandled exceptions.

Learn more

OWASP Web Security Testing Guide: Testing for Improper Error Handling

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ46

Community Discussion