CAS-003 · Question #829
A security engineer has just been embedded in an agile development team to ensure security practices are maintained during frequent release cycles. A new web application includes an input form…
The correct answer is C. Fuzzing possible input of the form. Fuzzing is the most effective technique for discovering how an application handles unexpected or malformed input by automatically injecting a wide range of boundary and error-inducing values into input fields.
Question
A security engineer has just been embedded in an agile development team to ensure security practices are maintained during frequent release cycles. A new web application includes an input form. Which of the following would work BEST to allow the security engineer to test how the application handles error conditions?
Options
- ARunning a dynamic analysis at form submission
- BPerforming a static code analysis
- CFuzzing possible input of the form
- DConducting a runtime analysis of the code
How the community answered
(45 responses)- A4% (2)
- B7% (3)
- C71% (32)
- D18% (8)
Why each option
Fuzzing is the most effective technique for discovering how an application handles unexpected or malformed input by automatically injecting a wide range of boundary and error-inducing values into input fields.
Dynamic analysis at form submission observes running behavior but is too broad and unfocused to systematically test error conditions - it would require manual input crafting to reach the same coverage as fuzzing.
Static code analysis examines source code without executing it and cannot observe how the application actually behaves at runtime when processing specific error-inducing inputs.
Fuzzing submits large volumes of random, malformed, or boundary-exceeding input to the application form and observes how it responds, directly targeting error-handling paths that manual testing would miss. It is specifically designed to surface crashes, unexpected behavior, and error conditions caused by unanticipated input, making it the best tool for this scenario.
Runtime analysis monitors execution flow and memory but is a passive observation technique that requires specific inputs to trigger error paths, not a method for systematically generating those inputs.
Concept tested: Fuzz testing web application input validation and error handling
Source: https://owasp.org/www-community/Fuzzing
Topics
Community Discussion
No community discussion yet for this question.