nerdexam
CompTIA

CAS-002 · Question #827

A firm's Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment…

The correct answer is C. Sign a NDA with a large security consulting firm and use the firm to perform Grey box testing and. The CEO needs thorough vulnerability testing while protecting a proprietary codebase, which requires a binding confidentiality agreement with an expert external firm using a testing method that yields deeper insight than no-knowledge testing.

Integration of Computing, Communications and Business Disciplines

Question

A firm's Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment system being developed will be sold to a number of organizations and is in direct competition with another leading product. The CEO highlighted that code base confidentiality is of critical importance to allow the company to exceed the competition in terms of the product's reliability, stability, and performance. Which of the following would provide the MOST thorough testing and satisfy the CEO's requirements?

Options

  • ASign a MOU with a marketing firm to preserve the company reputation and use in-house
  • BSign a BPA with a small software consulting firm and use the firm to perform Black box testing
  • CSign a NDA with a large security consulting firm and use the firm to perform Grey box testing and
  • DUse the most qualified and senior developers on the project to perform a variety of White box

How the community answered

(16 responses)
  • A
    19% (3)
  • B
    25% (4)
  • C
    50% (8)
  • D
    6% (1)

Why each option

The CEO needs thorough vulnerability testing while protecting a proprietary codebase, which requires a binding confidentiality agreement with an expert external firm using a testing method that yields deeper insight than no-knowledge testing.

ASign a MOU with a marketing firm to preserve the company reputation and use in-house

A MOU (Memorandum of Understanding) is a non-binding cooperation agreement that does not legally protect code confidentiality, and a marketing firm has no technical expertise to identify complex software vulnerabilities.

BSign a BPA with a small software consulting firm and use the firm to perform Black box testing

A BPA (Blanket Purchase Agreement) is a procurement vehicle without confidentiality protections, and black box testing provides the least thorough coverage because testers have no knowledge of the internal architecture to guide their assessment.

CSign a NDA with a large security consulting firm and use the firm to perform Grey box testing andCorrect

An NDA (Non-Disclosure Agreement) with a large security consulting firm legally binds the testers to protect the proprietary codebase, directly satisfying the CEO's confidentiality requirement. Grey box testing grants testers partial knowledge of the system internals, enabling more thorough vulnerability discovery than black box testing while limiting full code exposure. A large, specialized security firm provides the expert-level skills the CEO identified as lacking in the internal IT staff.

DUse the most qualified and senior developers on the project to perform a variety of White box

The CEO explicitly stated that internal IT staff lack the knowledge to identify complex vulnerabilities, so assigning senior in-house developers to perform white box testing fails to introduce the external expertise required.

Concept tested: Security testing methodologies and NDA for code confidentiality

Source: https://csrc.nist.gov/publications/detail/sp/800-115/final

Topics

#security testing#NDA#grey box testing#code confidentiality

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice