CAS-003 · Question #832
An application developer is including third-party backported security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is…
The correct answer is B. Regression testing. Regression testing verifies that newly integrated code changes do not reintroduce previously fixed vulnerabilities, which is exactly the failure mode described when backported patches caused a resolved issue to resurface.
Question
An application developer is including third-party backported security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, reports come in that a previously resolved vulnerability has returned. Which of the following should the developer integrate into the process to BEST prevent this type of behavior?
Options
- APeer review
- BRegression testing
- CUser acceptance
- DDynamic analysis
How the community answered
(35 responses)- A9% (3)
- B74% (26)
- C14% (5)
- D3% (1)
Why each option
Regression testing verifies that newly integrated code changes do not reintroduce previously fixed vulnerabilities, which is exactly the failure mode described when backported patches caused a resolved issue to resurface.
Peer review is a manual process that depends on reviewer familiarity with all prior vulnerabilities and their fixes, making it unreliable for catching subtle interactions introduced by third-party backported patches.
Regression testing executes a suite of previously passing security and functional tests against the updated codebase after each change is integrated. When backported fixes alter code paths, regression tests detect whether those changes have inadvertently reactivated a vulnerability that was already remediated, catching the problem before public release.
User acceptance testing evaluates whether features meet business requirements and usability standards, not whether specific security vulnerabilities have been reintroduced by a code change.
Dynamic analysis examines runtime behavior but is not specifically designed to verify that previously fixed security issues remain fixed after code integration - it requires targeted test cases to catch regressions reliably.
Concept tested: Regression testing to prevent vulnerability reintroduction after patching
Source: https://owasp.org/www-community/controls/Static_Code_Analysis
Topics
Community Discussion
No community discussion yet for this question.