nerdexam
CompTIA

CAS-002 · Question #691

An online banking application has had its source code updated and is soon to be re-launched. The underlying infrastructure has not been changed. In order to ensure that the application has an…

The correct answer is A. Penetration test across the application with accounts of varying access levels (i.e. non- B. Code review across critical modules to ensure that security defects, Trojans, and backdoors. Since only the application source code changed and infrastructure remained the same, security testing should focus on the application layer through penetration testing and code review.

Enterprise Security

Question

An online banking application has had its source code updated and is soon to be re-launched. The underlying infrastructure has not been changed. In order to ensure that the application has an appropriate security posture, several security- related activities are required. Which of the following security activities should be performed to provide an appropriate level of security testing coverage? (Select TWO).

Options

  • APenetration test across the application with accounts of varying access levels (i.e. non-
  • BCode review across critical modules to ensure that security defects, Trojans, and backdoors
  • CVulnerability assessment across all of the online banking servers to ascertain host and
  • DFingerprinting across all of the online banking servers to ascertain open ports and services.
  • EBlack box code review across the entire code base to ensure that there are no security

How the community answered

(40 responses)
  • A
    68% (27)
  • C
    8% (3)
  • D
    20% (8)
  • E
    5% (2)

Why each option

Since only the application source code changed and infrastructure remained the same, security testing should focus on the application layer through penetration testing and code review.

APenetration test across the application with accounts of varying access levels (i.e. non-Correct

Penetration testing with accounts at varying privilege levels directly validates the updated application's authentication, authorization, and session management controls, simulating real attacker scenarios against the new code.

BCode review across critical modules to ensure that security defects, Trojans, and backdoorsCorrect

A targeted code review of critical modules is the most efficient way to detect security defects, backdoors, or Trojans that could have been introduced or left undetected during the source code update.

CVulnerability assessment across all of the online banking servers to ascertain host and

The underlying infrastructure has not changed, so a vulnerability assessment of the banking servers would not reveal issues introduced by the application code update.

DFingerprinting across all of the online banking servers to ascertain open ports and services.

Fingerprinting servers for open ports is an infrastructure-level reconnaissance activity irrelevant when only application code was modified and server configurations remain unchanged.

EBlack box code review across the entire code base to ensure that there are no security

A 'black box' code review is a contradiction in terms - black box testing means no access to source code, and reviewing the entire codebase is disproportionate when only specific modules were updated.

Concept tested: Application security testing scope after code changes

Source: https://csrc.nist.gov/publications/detail/sp/800-115/final

Topics

#penetration testing#code review#web application security#security testing coverage

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice