CT-STE: Certified Tester Security Test EngineerDemo

By ISTQB · Question Mode

QuestionQ8

Security Test Techniques

Which TWO of the following security tests for a mobile banking application are examples of static security testing?

Choose two
  • A Review of the source code of the application to identify vulnerabilities such as hardcoded passwords or insecure cryptographic functions.
  • B Runtime vulnerability scanning while the application is running on a test server, looking for vulnerabilities such as data leakage during user transactions.
  • C Penetration testing by simulating real-world attacks on the bank’s live web application, attempting to exploit session hijacking.
  • D Scanning, with a tool, the application’s source code for security flaws like buffer overflows or improper authentication mechanisms.
  • E Using a tool to interact with the application in a running state to scan for vulnerabilities such as cross-site scripting by sending inputs and analyzing responses.
Explanation

Static security testing examines source code without running the application. Manual source-code review can identify issues such as hardcoded passwords and insecure cryptographic functions, while static-analysis tools can scan source code for flaws such as buffer overflows and improper authentication mechanisms.

Community Discussion

No comments yet. Be the first to start the discussion!