Deck 10: Testing for Quality and Security

Question 1

Reliability testing is a technique that feeds random input data into applications just to see what happens to the results.

Answer 1

False

Question 2

A testing script needs to be created for every possible situation and attack that the program could encounter.

Answer 2

True

Question 3

The application will never be 100% secure.

Answer 3

True

Question 4

Unit testing catches errors that compilers won't find.

Question 5

Reliability of an application is when the application produces correct results despite being under attack or under extreme use.

Question 6

The more complexity that is added to the system, the more secure it becomes.

Question 7

It is better to use programmers for general testing because they are familiar with the architecture and code.

Question 8

The testing phase of any applications is only a minor phase of the lifecycle.

Question 9

Fuzz testing and reliability testing are conducted during system testing.

Question 10

Use cases are a great starting point for functional test scripts.

Question 11

Testing should generate error-free software.

Question 12

Unit testing is the lowest level of testing a developer can conduct.

Question 13

There are two types of resourcres needed to execute the test case: -Internal -External

Question 14

Internal threats don't pose any real problems and do not need to be considered.

Question 15

Testing software consists of running a battery of test cases using multiple techniques against a specific use case and evaluating the results for pass or fail marks.

Question 16

Security code scanners also report a number of false positives.

Question 17

Integrations testing is when two or more modules, web services, or platforms are linked together and tested.

Question 18

Penetrations testing is a very rare practice in the security field.

Question 19

Source-based fault injections is when you go into the source code and force an error or an attack non-manually.

Question 20

A system test involves only a portion of the application.

Question 21

What type of resources are tools or people who are hired on a temporary basis to come into a project, test the application, and report findings?

A) Internal
B) Tools
C) Application Guide
D) External

Question 22

When testing for resiliency, what is being evaluated?

A) Security vulnerabilities
B) Policies and procedures
C) Documentation
D) Software

Question 23

What type of testing implies executing the current use case using valid inputs and then comparing the real results with expected results for pass or failures

A) Dynamic
B) Static
C) Load
D) Stress

Question 24

Code reviews, if conducted right can have a very positive effect on the team.

Question 25

What type of scripts are specifically created for testing the security of the application?

A) Secure testing
B) automated
C) functional testing
D) User based

Question 26

What are people-intensive verification techniques that are conducted either formally or informally that allow peers to read code statements and look for common security vulnerabilities, such as hard-coded IDs or passwords,and general quality features?

A) Code scanners
B) Code Reviews
C) Load testers
D) Fuzzing

Question 27

What defines how effective security is tested and implemented within the software?

A) Software test plan
B) User Acceptance reports
C) Types of testing tools
D) Software Assurance

Question 28

What tool scans (parse) through static code and analyze the code base for security vulnerabilities

A) static code analyzers
B) Application Guide
C) Load testing
D) Brute force tools

Question 29

Coding for resiliency means accepting the fact that something bad will happen and that when it does, you will be ready.

Question 30

Static testing involves executing methods and techniques to test the code while running the application.

Question 31

What type of errors does unit testing find?

A) errors with third party code modules
B) heap management
C) logic errors
D) load balancing

Question 32

What is a technique that feeds random input data into applications just to see what happens to the results?

A) Brute force
B) Concurrent users
C) Load test
D) Fuzzing

Question 33

Who creates and approves the test plan?

A) Developers
B) Testers
C) Project Management
D) Business Analysts

Question 34

What are step-by-step instructions that depict a specific scenario or situation that the use case will encounter as well as the expected result?

A) Secure test scripts
B) Functional test scripts
C) User acceptance
D) Load testing

Question 35

Code review needs to include the developer who coded the software and one other person on the development team.

Question 36

Manually going into the source code and forcing an error or attack is called?

A) Unit testing
B) Source-based fault injections
C) fuzzing
D) code reviews

Question 37

What test is when two or more modules or platforms are linked together and tested?

A) System
B) Integration
C) Unit
D) Load

Question 38

Making something bad happen actually tests the dependencies and resiliency of the software.

Question 39

What is tested when the application produces correct results despite being under attack?

A) Integrity
B) Confidentiality
C) Fuzzing
D) Reliability

Question 40

What type of test involves a complete front-to-back execution of the entire application?

A) System
B) Unit
C) Integration
D) Acceptance

Question 41

What is the Holodeck tool used for?

A) Load testing
B) Heap management
C) fault simulation
D) brute force

Question 42

What type of errors do code scanners catch?

A) Security vulnerabilities
B) Heap management
C) Load testing
D) Logic errors

Question 43

What type of errors does integration testing find?

A) calls to services or third party modules
B) logic problems
C) syntax errors
D) reporting problems

Question 44

What is a simulation tool used for?

A) Syntax errors
B) Concurrent users
C) Security vulnerabilities
D) logic errors

Question 45

What type of errors does compilers find?

A) Log errors
B) Reporting errors
C) Heap managements
D) syntax