CT-STE: Certified Tester Security Test EngineerDemo

By ISTQB · Question Mode

QuestionQ25

Security Test Techniques

A banking application enables users to manage accounts, transfer funds, and view transaction history. The security-test policy requires robust regression testing that provides a high level of confidence that transactions can be performed securely.

A new feature is added that lets users schedule future-dated fund transfers. It entails changes to several modules, including the user interface (UI), backend APIs, authentication mechanisms, and database transactions.

Which of the following regression tests BEST meets the objective above?

  • A End-to-end test of funds transfer that attempts to perform SQL injection.
  • B Integration test verifying that authentication token is validated correctly.
  • C Component test of the database verifying that sensitive data is encrypted.
  • D Component test verifying that unauthorized users cannot access the API.
Explanation

An end-to-end funds-transfer security test exercises the integrated UI, API, authentication, and database transaction path affected by the feature. Attempting SQL injection also verifies that untrusted input cannot manipulate database queries during a sensitive transaction; a successful injection could allow unauthorized access to or modification of database data. Isolated component or single-integration tests provide narrower assurance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!