Courseiva

CCNA Secure Software Testing Questions

28 questions · Secure Software Testing topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selecthard

Which THREE factors should be considered when prioritizing findings from a DAST scan?

Select 3 answers
A.The time of day the scan was performed.
B.The number of lines of code in the component.
C.The ease of exploitability and availability of exploits.
D.The sensitivity of the data handled by the vulnerable endpoint.
E.The CVSS base score of the vulnerability.
AnswersC, D, E

Easier exploits are a higher priority.

Why this answer

Risk is a function of the vulnerability's severity, the sensitivity of the data involved, and the exploitability.

Practice this question →
2
MCQeasy

You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?

A.Unit testing with hardcoded values.
B.Static code analysis.
C.null
D.DAST scanning with default payloads.
E.Mutation-based fuzzing.
AnswerE

Mutation fuzzing systematically perturbs valid inputs to trigger unexpected behavior.

Why this answer

Mutation-based fuzzing takes valid inputs and alters them, which is highly effective for finding edge cases in protocol parsers.

Practice this question →
3
MCQhard

During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?

A.null
B.The DAST scanner is conflicting with the IAST agent.
C.The agent is not correctly configured to recognize the application's specific data access abstraction layer.
D.The source code repository is not accessible to the agent.
E.The build server lacks sufficient CPU cores for runtime instrumentation.
AnswerC

IAST requires accurate mapping of custom ORMs to underlying database drivers.

Why this answer

IAST instruments the runtime environment; if the code uses an abstraction layer or ORM that the IAST agent does not map to database sinks, it may misinterpret harmless data transformations as vulnerabilities.

Practice this question →
4
Multi-Selecthard

When setting up a penetration testing lab for a web application, which THREE network configurations are recommended?

Select 3 answers
A.Enable full logging and monitoring on the testing infrastructure.
B.Configure the lab to use the main corporate production database.
C.Air-gap the testing network from the internet.
D.Implement a firewall between the test network and the rest of the company network.
E.Use a dedicated, isolated subnet for all testing traffic.
AnswersA, D, E

Essential for auditing test actions.

Why this answer

Security labs must be isolated to prevent accidental impact on production while maintaining necessary access for testing tools.

Practice this question →
5
MCQmedium

A company is implementing a Secure SDLC. Which phase is the most appropriate to start defining security test cases?

A.Requirements and Design.
B.Testing.
C.Maintenance.
D.null
E.Implementation.
AnswerA

Defining tests early allows for security-driven development.

Why this answer

Security test cases should be derived during the Requirements and Design phases to ensure that security features are verified as they are built.

Practice this question →
6
MCQmedium

A security auditor is using OWASP ZAP and wants to perform an authenticated scan. Which ZAP feature should they use to maintain the session across different scan requests?

A.The 'Forced User' mode in the site tree.
B.The 'Spider' tab's login configuration.
C.The 'Ajax Spider' timeout configuration.
D.Session Management configuration in the Context settings.
E.null
AnswerD

This allows ZAP to understand how to handle session tokens and authentication states.

Why this answer

ZAP's Session Management settings allow the user to define how the application tracks sessions, such as via specific cookies or headers.

Practice this question →
7
Multi-Selecthard

When designing a test case for secure API authentication, which THREE elements should be included?

Select 3 answers
A.Validating that error messages do not disclose account existence.
B.Testing for insecure token storage.
C.Ensuring token expiration and revocation work correctly.
D.Automating the password recovery workflow.
E.Testing the speed of the API response.
AnswersA, B, C

Prevents enumeration attacks.

Why this answer

Authentication testing must verify token handling, error messaging, and session management.

Practice this question →
8
Multi-Selecteasy

Which TWO of the following represent common output formats for security testing reports?

Select 2 answers
A.PNG.
B.PDF.
C.MP3.
D.BIOS.
E.JSON.
AnswersB, E

Standard for human-readable reports.

Why this answer

Industry standard formats for reporting include PDF for documentation and JSON for pipeline automation integration.

Practice this question →
9
MCQmedium

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

A.null
B.Changing the user agent header to a random string.
C.Injecting characters like single quotes (') and comments (--) into input fields.
D.Uploading a large file to test buffer overflow.
E.Adding a long string to an email field.
AnswerC

These are classic SQL injection payloads to test if the application sanitizes input.

Why this answer

Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Practice this question →
10
Multi-Selectmedium

Which TWO of the following practices are recommended when performing fuzz testing on a web service?

Select 2 answers
A.Disable all logging to improve fuzzing speed.
B.Manually input all test cases.
C.Isolate the fuzzing environment from production data.
D.Use a production environment for maximum realism.
E.Monitor application logs for crash signals and exceptions.
AnswersC, E

Essential to avoid corruption of real databases.

Why this answer

Fuzzing requires a controlled environment and proper input sanitization tracking to be effective.

Practice this question →
11
MCQmedium

A security engineer is analyzing a report from a SAST tool (e.g., Fortify). A finding is marked as 'Low Confidence'. What does this imply?

A.The finding is likely a false positive and requires manual validation.
B.The vulnerability is not exploitable.
C.null
D.The vulnerability is critical but rare.
E.The tool failed to scan the file.
AnswerA

Confidence levels represent the tool's certainty in the vulnerability's existence.

Why this answer

Low confidence findings are often heuristics-based and carry a high probability of being false positives, requiring manual verification.

Practice this question →
12
MCQhard

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

A.null
B.Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.
C.Use the same JWT throughout the entire fuzzing duration.
D.Exclude the Authorization header from the fuzzing target.
E.Disable authentication for the entire API during the test.
AnswerB

JWTs usually have short expiration times; the fuzzer must handle this.

Why this answer

The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Practice this question →
13
Multi-Selectmedium

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

Select 2 answers
A.Reduced developer education.
B.Immediate feedback on secure coding patterns.
C.Early identification of vulnerabilities.
D.Elimination of all false positives.
E.Automation of penetration testing.
AnswersB, C

Developers get immediate results as they write code.

Why this answer

SAST early in the SDLC reduces the cost of remediation and improves developer awareness of secure coding practices.

Practice this question →
14
Multi-Selectmedium

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

Select 3 answers
A.Testing the password recovery/reset workflow.
B.Changing the application's CSS file.
C.Manipulating session cookies.
D.Testing the application's color scheme.
E.Brute forcing account credentials.
AnswersA, C, E

Often overlooked as a bypass vector.

Why this answer

Authentication bypass tests focus on session manipulation, password reset flows, and credential brute forcing.

Practice this question →
15
MCQmedium

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

A.null
B.Set the analysis mode to 'Incremental' only.
C.Increase the heap memory allocation for the JVM running the scanner.
D.Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.
E.Configure the 'Exclude' patterns to include all library dependencies.
AnswerD

Taint analysis is the primary mechanism for tracking data from sources to sinks in SAST.

Why this answer

The analysis of data flow paths requires the enablement of security hotspots and taint analysis rules in the Quality Profile.

Practice this question →
16
MCQmedium

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

A.Attempt to brute force the user's password.
B.Extract and re-inject unique anti-CSRF tokens for each request.
C.null
D.Scan the client-side JavaScript code for vulnerabilities.
E.Bypass the need for authentication.
AnswerB

Without token handling, the application will reject the forged request.

Why this answer

CSRF tokens are unique per session; the scanner must be able to extract the token from the response and include it in the subsequent request.

Practice this question →
17
MCQeasy

Which testing methodology provides the best visibility into the internal logic of an application while it is running?

A.Penetration testing.
B.DAST.
C.SAST.
D.null
E.IAST.
AnswerE

IAST instruments the runtime application, providing deep visibility.

Why this answer

IAST (Interactive Application Security Testing) combines the benefits of SAST (visibility into code) and DAST (runtime analysis).

Practice this question →
18
MCQmedium

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

A.Configuring the fuzzer to use only random byte-flipping.
B.null
C.Running the fuzzer on a virtual machine without network access.
D.Instrumenting the code during compilation with afl-clang or afl-gcc.
E.Providing the fuzzer with a binary that was stripped of all symbols.
AnswerD

Instrumentation provides the feedback mechanism AFL uses to find new code paths.

Why this answer

AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Practice this question →
19
MCQeasy

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

A.Delete the record to prove the IDOR is exploitable.
B.Attempt to access resources associated with other users.
C.null
D.Report the finding immediately without further testing.
E.Run a full automated DAST scan against the entire application.
AnswerB

This confirms the scope and impact of the IDOR vulnerability.

Why this answer

Once IDOR is found, the tester should attempt to access resources belonging to different users to confirm the vulnerability's scope.

Practice this question →
20
MCQeasy

Which of the following is the primary purpose of a DAST scan in a DevSecOps environment?

A.Instrument code to monitor data flow at runtime.
B.null
C.Analyze source code for insecure coding patterns.
D.Perform unit testing on individual functions.
E.Identify vulnerabilities in the running application from the outside in.
AnswerE

DAST is a black-box testing methodology for running applications.

Why this answer

DAST tests the application in its running state, identifying vulnerabilities that are exposed through the interface, unlike SAST which looks at source.

Practice this question →
21
MCQhard

You are integrating Snyk into a CI pipeline. The scan is failing the build even when no new vulnerabilities are introduced. What is the cause?

A.An expired 'ignore' policy in the .snyk file.
B.null
C.The Snyk token has expired.
D.The scan speed is set to 'High'.
E.The dependencies are already updated.
AnswerA

If a vulnerability was ignored until a specific date and that date has passed, the build will fail.

Why this answer

Snyk's 'policy' or '.snyk' file can be configured with 'ignore' rules that expire, or thresholds that trigger build breaks if policy is violated.

Practice this question →
22
MCQmedium

When using Burp Suite Professional to perform DAST against a web application with a complex multi-step form, what is the most effective way to ensure the scanner completes the workflow?

A.Decrease the number of concurrent scan threads.
B.null
C.Enable 'Live Passive Crawling'.
D.Set the 'Scan Speed' to 'Thorough'.
E.Use the 'Macros' feature in Project Options to record and replay the sequence of authentication steps.
AnswerE

Macros are specifically designed to handle session state and multi-step workflows.

Why this answer

Burp Suite's Macro functionality allows the recorder to automate sessions and handle stateful transitions during scanning.

Practice this question →
23
Multi-Selectmedium

Which TWO of the following are common challenges when implementing IAST?

Select 2 answers
A.Requirement for full source code access.
B.Inability to find vulnerabilities in unreachable code.
C.Lack of false positives.
D.Difficulty in installing agents on client machines.
E.Performance overhead on the application.
AnswersB, E

IAST can only see what executes during testing.

Why this answer

IAST implementation challenges typically revolve around performance overhead and compatibility with the application stack.

Practice this question →
24
MCQhard

You are auditing a SAST tool's findings for a Java application. The tool flags a potential XSS in a JSP file, but the output is encoded using a library. How should you classify this finding?

A.Informational.
B.Mitigated / False Positive.
C.null
D.Confirmed Vulnerability.
E.Critical.
AnswerB

Proper encoding effectively mitigates XSS risk.

Why this answer

If the application uses proper context-aware encoding, the vulnerability is mitigated; the SAST tool likely flagged the use of a sink without verifying the preceding encoding.

Practice this question →
25
MCQhard

When configuring a custom scan in Nessus to identify vulnerabilities in a web-based management interface, which setting is essential for deep authenticated scanning?

A.Disabling the 'Plugin' set for OS detection.
B.Enabling 'Safe Checks' in the policy settings.
C.Providing the 'Authentication' credentials in the 'Web Applications' section.
D.Configuring the 'Port Scanner' to only scan port 80.
E.null
AnswerC

Without valid authentication, a scanner only sees the public login page.

Why this answer

Nessus needs credentials (HTTP/HTML form authentication) to access protected pages to perform a full vulnerability assessment.

Practice this question →
26
MCQeasy

When performing automated security testing, which of the following is considered a 'false positive'?

A.The scanner reports a vulnerability that is not present in the application.
B.The scanner misses an existing vulnerability.
C.The scanner causes the application to crash.
D.The scanner reports a vulnerability that is already fixed.
E.null
AnswerA

This is the definition of a false positive.

Why this answer

A false positive is a report of a vulnerability that does not actually exist in the target application.

Practice this question →
27
MCQhard

You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?

A.The vulnerability is a logic error that static analysis cannot find.
B.The .NET framework version is set incorrectly in the project settings.
C.The scan engine is set to 'Quick Scan' mode.
D.The third-party DLL is not configured as a source project or included in the scan scope.
E.null
AnswerD

SAST tools need access to code or dependencies to perform data flow analysis.

Why this answer

Checkmarx requires binary/source access for full scanning; if the third-party DLL is not included as a source or dependency project, it cannot be analyzed effectively.

Practice this question →
28
MCQeasy

When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?

A.SQLmap.
B.null
C.Postman.
D.Nmap.
E.Wireshark.
AnswerC

Postman allows for easy manipulation of request parameters to test BOLA.

Why this answer

Postman or Burp Suite are used to manually manipulate IDs in API requests to see if unauthorized access is granted to other objects.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Secure Software Testing questions.

Start 20-question session