nerdexam
CompTIA

CAS-003 · Question #832

An application developer is including third-party backported security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is…

The correct answer is B. Regression testing. Regression testing verifies that newly integrated code changes do not reintroduce previously fixed vulnerabilities, which is exactly the failure mode described when backported patches caused a resolved issue to resurface.

Research, Development and Collaboration

Question

An application developer is including third-party backported security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, reports come in that a previously resolved vulnerability has returned. Which of the following should the developer integrate into the process to BEST prevent this type of behavior?

Options

  • APeer review
  • BRegression testing
  • CUser acceptance
  • DDynamic analysis

How the community answered

(35 responses)
  • A
    9% (3)
  • B
    74% (26)
  • C
    14% (5)
  • D
    3% (1)

Why each option

Regression testing verifies that newly integrated code changes do not reintroduce previously fixed vulnerabilities, which is exactly the failure mode described when backported patches caused a resolved issue to resurface.

APeer review

Peer review is a manual process that depends on reviewer familiarity with all prior vulnerabilities and their fixes, making it unreliable for catching subtle interactions introduced by third-party backported patches.

BRegression testingCorrect

Regression testing executes a suite of previously passing security and functional tests against the updated codebase after each change is integrated. When backported fixes alter code paths, regression tests detect whether those changes have inadvertently reactivated a vulnerability that was already remediated, catching the problem before public release.

CUser acceptance

User acceptance testing evaluates whether features meet business requirements and usability standards, not whether specific security vulnerabilities have been reintroduced by a code change.

DDynamic analysis

Dynamic analysis examines runtime behavior but is not specifically designed to verify that previously fixed security issues remain fixed after code integration - it requires targeted test cases to catch regressions reliably.

Concept tested: Regression testing to prevent vulnerability reintroduction after patching

Source: https://owasp.org/www-community/controls/Static_Code_Analysis

Topics

#regression testing#backported patches#SDLC#vulnerability recurrence

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice