Security Testing Methods Flashcards

Question 1

What is a vulnerability in the context of security testing?

Accepted Answer

A vulnerability is a weakness in a system, application, or process that could be exploited to cause unauthorized access, data exposure, disruption, or other harm. Vulnerabilities can come from coding errors, misconfigurations, weak design, or poor operational practices. Testing aims to find them before someone with malicious intent does.

Question 2

How does a threat differ from a vulnerability?

Accepted Answer

A threat is any actor, event, or circumstance with the potential to cause harm, such as an attacker, a malware campaign, or a natural disaster. A vulnerability is the weakness that a threat could use. Risk arises when a threat meets a vulnerability and the potential impact is significant.

Question 3

What is the difference between security testing and functional testing?

Accepted Answer

Functional testing checks whether a feature behaves as specified under expected inputs. Security testing checks whether the system resists misuse, such as malicious inputs, unauthorized access, or abuse of trust relationships. A feature can pass every functional test and still contain serious security flaws, which is why both types are needed.

Question 4

What does the CIA triad represent in security testing?

Accepted Answer

The CIA triad is a model of three core security goals: confidentiality, integrity, and availability. Confidentiality means information is seen only by authorized parties. Integrity means data is not altered improperly. Availability means systems and data are accessible to authorized users when needed. Tests usually target one or more of these goals.

Question 5

What is the purpose of a threat model in security testing?

Accepted Answer

A threat model is a structured description of what assets a system holds, who might attack it, how they could do so, and which controls reduce the risk. Testers use it to decide where to focus effort and which scenarios to test first. It converts a general goal of security into specific, testable questions.

Question 6

What is the principle of least privilege and why does it matter for testing?

Accepted Answer

Least privilege means each user, process, or service receives only the access needed to perform its function. Testers check whether accounts have excessive rights, since over-privileged accounts turn a small compromise into a major one. Verifying this principle helps reveal how far an attacker could move after gaining an initial foothold.

Question 7

What is the difference between black box, white box, and gray box testing?

Accepted Answer

Black box testing gives the tester no internal knowledge and simulates an outsider. White box testing provides full access to source code, design documents, and credentials. Gray box testing sits between the two, typically with limited knowledge such as a standard user account or architecture overview. Each approach answers different questions about the system.

Question 8

Why is documenting scope and rules of engagement important before a security test?

Accepted Answer

Scope defines which systems, networks, and techniques are approved for testing, while rules of engagement set timing, contacts, and permitted actions. Written agreement from the system owner protects both the tester and the organization, and it prevents accidental damage to systems outside the approved boundary. Without clear scope, testing may be unauthorized.

Question 9

What is static application security testing and how does it work?

Accepted Answer

Static application security testing analyzes source code, bytecode, or binaries without running the program. Tools parse the code and flag patterns linked to weaknesses, such as unsanitized input reaching a database query. It can run early in development and examine code paths that are hard to trigger during execution, though findings often need human review.

Question 10

How does dynamic application security testing differ from static analysis?

Accepted Answer

Dynamic application security testing, or DAST, examines a running application from the outside by sending requests and observing responses. It does not need source code, so it can assess the deployed behavior, configuration, and server responses. Static analysis inspects code at rest, while dynamic testing finds problems that only appear during execution.

Question 11

What is interactive application security testing and where does it fit?

Accepted Answer

Interactive application security testing, or IAST, places an agent inside a running application to monitor how code executes while automated or manual tests send requests. This combines visibility into code behavior together with runtime context. It is typically used during quality assurance, where test traffic can reveal data flow problems that other methods miss.

Question 12

What is a code review and what kinds of issues does it catch best?

Accepted Answer

A security code review is a manual examination of source code by a person who looks for logic flaws, unsafe design choices, and missing controls. Human reviewers excel at spotting issues that depend on business context, such as authorization checks applied inconsistently across endpoints. Automated tools complement reviews by scanning, but they rarely understand intent.

Question 13

How do software composition analysis tools help testers?

Accepted Answer

Software composition analysis identifies third-party and open source components in an application and checks them against databases of known vulnerabilities. Many applications rely heavily on libraries, so an unpatched dependency can expose the whole product even when the custom code is sound. Results usually list component versions, known issues, and suggested upgrade paths.

Question 14

What is taint analysis and why is it used in static security testing?

Accepted Answer

Taint analysis tracks data that comes from untrusted sources, such as form fields or network packets. Analysts label that data as tainted and check whether it reaches sensitive sinks, such as command execution or SQL queries, without proper validation or encoding. It helps explain injection flaws.

Question 15

Why do false positives matter in static and dynamic analysis?

Accepted Answer

A false positive is a reported issue that is not actually exploitable or does not exist. Too many false positives waste developer time and can cause teams to ignore alerts, which hides real problems. Testers reduce this burden by validating findings, tuning rules, and recording why an alert was dismissed.

Question 16

How can testers combine static and dynamic methods in one program?

Accepted Answer

A common approach runs static analysis early and often, then uses dynamic testing against builds in a staging environment. Findings from each method are compared, since a flaw confirmed at runtime deserves higher priority than one that only appears in code. This layered approach balances broad early coverage with realistic verification.

Question 17

What is vulnerability scanning and how does it differ from penetration testing?

Accepted Answer

Vulnerability scanning uses automated tools to identify known weaknesses, misconfigurations, and missing patches across many systems. Penetration testing is a goal-driven attempt to exploit weaknesses, combining automated tools with human judgment to see how far an attacker could go. Scans show breadth and speed, while penetration tests show whether weaknesses can be chained into impact.

Question 18

What role does reconnaissance play at the start of a penetration test?

Accepted Answer

Reconnaissance is the information gathering phase in which testers identify hosts, domains, services, employees, and technologies that belong to the target. Passive techniques rely on public sources and avoid direct contact, while active techniques send probes that may be logged. The results shape which attack paths are worth testing next.

Question 19

What is port scanning, and what information can it reveal about a host?

Accepted Answer

Port scanning sends connection attempts or packets to a range of ports to determine which ones are open, closed, or filtered. The responses can reveal running services, their versions, and sometimes the operating system. Port scanning is noisy and can trigger alerts, so testers usually agree on its timing and intensity in advance.

Question 20

How does credentialed vulnerability scanning differ from uncredentialed scanning?

Accepted Answer

Uncredentialed scanning examines a system from the outside without logging in, which shows what an unauthenticated attacker could see. Credentialed scanning uses valid accounts to inspect installed software, patch levels, and local settings, which usually finds far more issues. Organizations often run both, since each view answers a different question about exposure.

Question 21

What is exploitation, and why should testers prove impact carefully?

Accepted Answer

Exploitation is the controlled use of a weakness to gain access, execute code, or reach data it should protect. Testers aim to demonstrate impact with the least disruption possible, often using harmless proof values or read-only queries. Careful proof avoids damaging production data and gives system owners clear evidence to prioritize repairs.

Question 22

What does privilege escalation mean during a penetration test?

Accepted Answer

Privilege escalation means moving from a low-level account to one with greater rights, such as becoming an administrator or root. It is often a key step after an initial foothold, because the attacker gains the ability to read protected files and change settings. Testers document each step to show how the escalation happened.

Question 23

Why do testers chain multiple low-severity findings together?

Accepted Answer

Individually minor issues can combine into a serious attack path, such as an information leak that reveals a username, paired with a weak password policy. Chaining shows the real risk that a single finding in isolation may hide. This is why reports should describe attack paths and not rank each issue alone.

Question 24

What rules should guide a tester who discovers a critical flaw mid-engagement?

Accepted Answer

The tester should stop further exploitation of that issue, record the evidence, and notify the designated client contact according to the rules of engagement. Testing should resume only after the client confirms how to proceed, because a critical issue may affect live operations. Escalation procedures prevent a discovery from turning into an unplanned incident.

Question 25

How do testers use common web application risk categories in their work?

Accepted Answer

Testers use these categories as a checklist of frequently seen web flaws, such as injection, broken access control, and security misconfiguration. Each category suggests test ideas, including malicious input, altered requests, and checks for default settings. The categories help teams plan coverage, although they do not replace testing for flaws unique to an application's logic.

Question 26

How do testers detect SQL injection in a web application?

Accepted Answer

SQL injection occurs when user-supplied input changes the structure of a database query because it is concatenated rather than passed as a parameter. Testers detect it by submitting characters such as quotes or logical expressions and watching for database errors, altered results, or timing differences. Parameterized queries and input validation are the standard defenses.

Question 27

What is cross-site scripting and what is the basic test approach?

Accepted Answer

Cross-site scripting, or XSS, happens when an application includes untrusted input in a page without proper encoding, allowing a script to run in another user's browser. Testers submit harmless marker strings into fields and check whether they appear unencoded in responses. Context matters, since attribute values need different handling than plain text.

Question 28

What is broken access control and how do testers check for it?

Accepted Answer

Broken access control means users can perform actions or view data beyond their intended permissions. Testers check it by logging in as different roles and attempting to reach each other's resources, such as changing an identifier in a URL to view another account. Servers must enforce authorization, not just hide options in the interface.

Question 29

What is network vulnerability testing and which services are commonly checked?

Accepted Answer

Network vulnerability testing assesses hosts, routers, firewalls, and the services they expose to find unpatched software, weak configurations, and unnecessary exposure. Commonly checked services include remote access protocols, file sharing, directory services, and web or database interfaces. Testers verify findings with careful, minimal checks to avoid disrupting network operations.

Question 30

How do testers assess default and weak credentials?

Accepted Answer

Testers check whether systems still use vendor default accounts or easily guessed passwords, which attackers try first. Authorized checks may compare credentials against approved lists and apply controlled, rate-limited guessing that respects lockout policies. Findings should lead to unique credentials, strong password requirements, and multifactor authentication where feasible.

Question 31

What is the purpose of testing for insecure session management?

Accepted Answer

Session management testing checks whether the application issues, protects, and expires session identifiers correctly after login. Testers look for predictable tokens, identifiers exposed in URLs, sessions that do not expire after logout, and cookies missing protective attributes. Weak session handling can let an attacker take over an authenticated user's activity without knowing the password.

Question 32

How does a tester check whether a server's TLS configuration is weak?

Accepted Answer

Testers connect to the service and review the protocol versions, cipher suites, and certificate details it offers. Outdated protocol versions, weak ciphers, expired or mismatched certificates, and weak key sizes are common findings. Tools can automate this review, but a tester should confirm results and recommend settings that match the organization's compatibility needs.

Question 33

How is risk commonly expressed when security findings are rated?

Accepted Answer

Risk is commonly expressed as the combination of the likelihood that a threat exploits a weakness and the impact if it does. Testers estimate both factors using the evidence gathered, the exposure of the system, and the value of the affected data. Clear reasoning about likelihood and impact helps stakeholders compare findings fairly.

Question 34

What is the Common Vulnerability Scoring System used for?

Accepted Answer

The Common Vulnerability Scoring System is a standardized method for rating technical severity on a numeric scale. It scores factors such as attack complexity, required privileges, and effect on confidentiality, integrity, and availability. A base score is useful for comparison, but teams should adjust it with environmental context, such as exposure to the internet.

Question 35

What elements should a good security finding write-up include?

Accepted Answer

A strong finding describes the issue, the affected components, the steps to reproduce it, and the evidence collected. It explains the business impact in plain language and recommends specific remediation steps with priority. Writing that others can verify without the tester present is the goal.

Question 36

Why is reproducibility important for a reported vulnerability?

Accepted Answer

Reproducibility means another person can follow the documented steps and observe the same result. It lets developers confirm the issue, understand its cause, and verify that a fix works. Without it, teams may waste time disputing findings or may close issues that were never truly resolved.

Question 37

What is a false negative and why is it hard to measure?

Accepted Answer

A false negative is a real vulnerability that a test fails to report. It is hard to measure because the tester does not know what the test missed, and no single tool or method finds everything. Teams reduce the risk by using several methods, reviewing coverage, and learning from incidents or later findings.

Question 38

How should remediation priorities be set after testing?

Accepted Answer

Remediation priorities should combine severity, likelihood, exposure, and the value of the affected asset. A critical flaw on an internet-facing system usually comes first, while a low-risk issue on an isolated test server may wait. Teams should also consider the effort required, since quick wins can reduce overall exposure while larger changes are planned.

Question 39

What is retesting and why do organizations perform it?

Accepted Answer

Retesting repeats the original test steps after a fix is applied to confirm that the vulnerability is no longer exploitable. It also checks that the change did not introduce a new weakness or break a related control. Organizations rely on retesting to close findings with evidence rather than assumptions.

Question 40

How can testing results support continuous improvement beyond a single engagement?

Accepted Answer

Patterns across findings reveal root causes, such as repeated input handling mistakes or weak review practices, which training, secure coding standards, and design changes can address. Tracking trends over time shows whether security efforts are improving. Feeding lessons back into threat models and test plans keeps future assessments focused on the most relevant risks.

Security Testing Methods Flashcards

1Foundations of security testing

2Static and dynamic analysis

3Penetration testing and scanning

4Web and network testing

5Reporting, risk, and remediation

Learning Resources