Domain 6: Security Assessment and Testing pt 2

Question 1

• Attempts to identity the degree to which code testing applies to the entire application
• Goal is to ensure there are no significant gaps in the testing of software that would allow for bugs and security vulnerabilities

Answer 1

Test Coverage Analysis

Question 2

The goal here is to ensure that security is uniformly applied across the various facets of an application

Answer 2

Interface Testing

Question 3

Common Vulnerability Scoring System (CVSS) is influenced by what three metrics?

Answer 3

1. Base metrics
2. Temporal metrics
3. Environmental metrics

Question 4

• Common Vulnerability Scoring System (CVSS) metric
• Indicates the severity of the vulnerability
• Established by the vendor has the largest influence on the final CVSS score

Answer 4

Base metrics

Question 5

• Common Vulnerability Scoring System (CVSS) metric
• Indicates the urgency of the vulnerability
• Established by the vendor or originator and can change over time

Answer 5

Temporal metrics

Question 6

• Common Vulnerability Scoring System (CVSS) metric
• Optional indicates how much an organization or end-user is affected by a vulnerability
• Established by each end-user organization

Answer 6

Environmental metrics

Question 7

Modifies previous known inputs from actual operation of the software to generate synthetic inputs that may trigger unexpected behavior

Answer 7

Mutation fuzzing

Question 8

Develops inputs based on models of expected inputs to perform the same task

Answer 8

Generational fuzzing

Question 9

• Administrator activity

- Ensures that systems are not misused

Answer 9

Log Reviews

Question 10

Ensures only authorized users retain access to information systems

Answer 10

Account management reviews

Question 11

Ensures that the organization’s data protection process is functioning properly

Answer 11

Backup verification

Question 12

Provides a high-level view of the security program effectiveness

Answer 12

Key performance and risk

Question 13

• Type of interface that should be tested during the software testing process
• Allow code models a way to interact and may be exposed to the outside world

Answer 13

Application Programming Interfaces (APIs)

Question 14

• Type of interface that should be tested during the software testing process
• Provides end users the ability to interact with the software (i.e. GUI)

Answer 14

User Interfaces (UIs)

Question 15

• Type of interface that should be tested during the software testing process
• Applications that manipulate machinery (i.e. machinery, logic controller, or other objects in the physical world)

Answer 15

Physical Interfaces

Question 16

What is the formula for the Test Coverage Analysis?

Answer 16

test coverage = number of use cases tested / total number of use cases

Question 17

What are the 5 common criteria that can be used in the Test Coverage Analysis?

Answer 17

1. Branch Coverage
2. Condition Coverage
3. Function Coverage
4. Loop Coverage
5. Statement Coverage

Question 18

• Common criteria for Test Coverage Analysis

- Has every if statement been executed under all if and else conditions?

Answer 18

Branch Coverage

Question 19

• Common criteria for Test Coverage Analysis

- Has every logical test in the code been executed under all sets of inputs?

Answer 19

Condition Coverage

Question 20

• Common criteria for Test Coverage Analysis

- Has every function in the code been called and returned results?

Answer 20

Function Coverage

Question 21

• Common criteria for Test Coverage Analysis
• Has every loop in the code been executed under conditions that cause code execution multiple times, only once, and not at all?

Answer 21

Loop Coverage

Question 22

• Common criteria for Test Coverage Analysis

- Has every line of code been executed during the test?

Answer 22

Statement Coverage

Question 23

• Website monitoring

- Analyzes actual network traffic sent to a website by capturing it as it travels the network

Answer 23

Passive Monitoring

Question 24

• Website monitoring
• Resembles the activity of individual users to track their interaction with the website
• Variant of passive monitoring

Answer 24

Real User Monitoring

Question 25

• Website monitoring

- Performs artificial transactions against a website to assess performance

Answer 25

Synthetic Monitoring (or active Monitoring)

Question 26

List the 6 processes for the Fagan inspection

Answer 26

1. Planning
2. Overview
3. Preparation
4. Inspection
5. Rework
6. Follow-up