Security Testing Practice Questions

Answers and explanations appear when you work through the set above.

1. A company commissions an external penetration test and gives the testers only public IP ranges and the company name. Which testing perspective is being used?

   • Black box
   • White box
   • Grey box
   • Known environment testing

2. Before an approved penetration test begins, what is the MOST important management action?

   • Begin exploitation and use the hosts reached to set test scope
   • Collect screenshots for the final report
   • Disable monitoring so the test is not detected
   • Approve scope, rules of engagement, contacts, and safety limits

3. A security director wants to improve both attack emulation and defensive detection during an exercise. Which team arrangement BEST supports shared learning while the exercise is underway?

   • A red team that operates without any defenders
   • A purple team with offensive and defensive collaboration
   • A blue team that performs only vulnerability scanning
   • A white-box assessment performed by an auditor

4. Which statement BEST distinguishes SAST, DAST, and IAST in an application security program?

   • SAST tests only network traffic, DAST reads source code, and IAST replaces code review
   • SAST and DAST both require production deployment, while IAST runs only during design
   • SAST: code analysis without execution; DAST: external runtime testing; IAST: instrumented execution
   • SAST performs black-box network tests, DAST reviews source as white-box testing, and IAST checks infrastructure configuration

5. A development team wants to expose parser crashes and unexpected handling of malformed API messages before release. Which technique should the manager prioritize?

   • Fuzz testing with generated or mutated inputs
   • Synthetic transaction monitoring with valid business requests
   • Coverage analysis of documented requirements only
   • A white-box penetration test of the network perimeter

6. A bank must verify every five minutes that its customer login, balance inquiry, and logout workflow remains available after a deployment. Which test is MOST appropriate?

   • A one-time vulnerability scan
   • A red team campaign focused on lateral movement and privilege escalation after initial access
   • A source code review of the authentication module
   • An automated synthetic transaction exercising the workflow

7. During requirements analysis, the team documents that an attacker may repeatedly alter an order request to obtain a lower price. What is the BEST next use of this information?

   • Treat price alteration as expected customer behavior and omit security tests
   • Convert the attack into a misuse case and derive security test scenarios
   • Use it only to calculate source-code statement coverage
   • Replace all functional tests with a vulnerability scan

8. A test report states that 95 percent of statements executed, but an authorization branch for an administrator-only API was never exercised. What should the manager conclude?

   • The application is secure because statement coverage exceeds 90 percent
   • The missing branch proves the vulnerability has already been exploited
   • A coverage gap requiring a targeted authorization test
   • The result demonstrates complete coverage of the application requirements

9. After a penetration test, the assessor finds a critical exploitable weakness and must communicate it responsibly. Which action should occur FIRST after validating the finding?

   • Publish the validated technical details and exploit procedure immediately to put pressure on the system owner
   • Delete the evidence to reduce organizational exposure
   • Wait until the next annual audit to mention it
   • Report via agreed management and ethical disclosure channels with remediation context