An online banking application has had its source code updated and is soon to be re-launched. The underlying infrastructure has not been changed. In order to ensure that the application has an…

Question

Options

• APenetration test across the application with accounts of varying access levels (i.e. non-authenticated,
• BCode review across critical modules to ensure that security defects, Trojans, and backdoors are not present.
• CVulnerability assessment across all of the online banking servers to ascertain host and container
• DFingerprinting across all of the online banking servers to ascertain open ports and services.
• EBlack box code review across the entire code base to ensure that there are no security defects present.

• A
  79% (30)
• C
  3% (1)
• D
  11% (4)
• E
  8% (3)

Explanation

Since only the source code changed (not the infrastructure), testing efforts should focus on the application layer. (A) A penetration test using accounts with varying privilege levels (unauthenticated, regular user, admin) validates that authentication, authorization, and application logic are secure from a real-world attacker's perspective. (B) A code review of critical modules directly inspects the updated source code for security defects, backdoors, or logic errors introduced during the update - essential since the code itself changed. Options C and D (vulnerability assessment and fingerprinting of servers) are less valuable because the underlying infrastructure has not changed. Option E describes a 'black box code review,' which is a contradiction - code review is inherently white-box; black box refers to runtime testing.

No community discussion yet for this question.