nerdexam
CompTIA

CAS-002 · Question #673

A company which manufactures ASICs for use in an IDS wants to ensure that the ASICs' code is not prone to buffer and integer overflows. The ASIC technology is copyrighted and the confidentiality of…

The correct answer is D. White box unit testing by the manufacturer and black box testing by the third party. White box unit testing by the manufacturer exposes overflow vulnerabilities in the proprietary code, while black box testing by the third party validates security externally without requiring access to the confidential ASIC design.

Technical Integration of Enterprise Components

Question

A company which manufactures ASICs for use in an IDS wants to ensure that the ASICs' code is not prone to buffer and integer overflows. The ASIC technology is copyrighted and the confidentiality of the ASIC code design is exceptionally important. The company is required to conduct internal vulnerability testing as well as testing by a third party. Which of the following should be implemented in the SDLC to achieve these requirements?

Options

  • ARegression testing by the manufacturer and integration testing by the third party
  • BUser acceptance testing by the manufacturer and black box testing by the third party
  • CDefect testing by the manufacturer and user acceptance testing by the third party
  • DWhite box unit testing by the manufacturer and black box testing by the third party

How the community answered

(19 responses)
  • A
    11% (2)
  • B
    26% (5)
  • C
    5% (1)
  • D
    58% (11)

Why each option

White box unit testing by the manufacturer exposes overflow vulnerabilities in the proprietary code, while black box testing by the third party validates security externally without requiring access to the confidential ASIC design.

ARegression testing by the manufacturer and integration testing by the third party

Regression testing validates that prior functionality still works after changes and integration testing checks component interactions - neither specifically targets buffer or integer overflow vulnerabilities at the source code level.

BUser acceptance testing by the manufacturer and black box testing by the third party

User acceptance testing evaluates whether a product meets end-user business requirements and is not a technique for detecting code-level security vulnerabilities such as buffer overflows.

CDefect testing by the manufacturer and user acceptance testing by the third party

Defect testing is a general and imprecise category that does not specifically address overflow detection, and user acceptance testing by the third party would expose the proprietary code, violating the confidentiality requirement.

DWhite box unit testing by the manufacturer and black box testing by the third partyCorrect

White box unit testing gives the manufacturer full visibility into the source code, allowing targeted analysis of specific code units for buffer overflows and integer overflows at the lowest level of granularity. Black box testing by the third party satisfies the external validation requirement by having testers interact only with inputs and outputs, never exposing the copyrighted and confidential ASIC code design. This pairing satisfies all three requirements - internal testing, third-party testing, and protection of IP confidentiality.

Concept tested: White box and black box SDLC testing for overflow vulnerabilities

Source: https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final

Topics

#SDLC#white box testing#black box testing#secure coding

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice