A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self service functionality. The application has been written by…

Question

Options

• APerform unit testing of the binary code
• BPerform code review over a sampling of the front end source code
• CPerform black box penetration testing over the solution
• DPerform grey box penetration testing over the solution
• EPerform static code review over the front end source code

• A
  12% (3)
• B
  19% (5)
• C
  8% (2)
• D
  62% (16)

Explanation

For maximum security coverage during the SDL test phase, combining static analysis with contextually informed dynamic testing provides the broadest coverage. Static code review of the full front-end source code (E) analyzes 100% of the code without executing it, surfacing vulnerabilities like injection flaws, insecure direct object references, cryptographic misuse, and logic errors that may never trigger during runtime testing. Grey box penetration testing (D) supplements this by simulating a realistic attacker who has partial knowledge of the system (e.g., documentation, APIs, or credentials)-this is more effective than black box (C) because testers can focus on high-risk functionality and find complex vulnerabilities that static analysis might miss. Black box testing (C) alone is less thorough because testers have no insight into the application internals. A code review over only a sampling (B) risks missing critical vulnerabilities in unreviewed code. Unit testing of binary code (A) is impractical and less relevant when source code is available.

No community discussion yet for this question.