nerdexam
(ISC)2

CCSP · Question #110

According to OWASP recommendations, active software security testing should include all of the following except ____________.

The correct answer is A. Session initiation testing. OWASP recommendations for active software security testing include input validation, error handling, and weak cryptography checks, but "Session initiation testing" is not a standard, distinct category within their common active testing methodologies like DAST.

Submitted by yuki_2020· Apr 18, 2026Cloud Application Security

Question

According to OWASP recommendations, active software security testing should include all of the following except ____________.

Options

  • ASession initiation testing
  • BInput validation testing
  • CTesting for error handling
  • DTesting for weak cryptography

How the community answered

(59 responses)
  • A
    83% (49)
  • B
    10% (6)
  • C
    5% (3)
  • D
    2% (1)

Why each option

OWASP recommendations for active software security testing include input validation, error handling, and weak cryptography checks, but "Session initiation testing" is not a standard, distinct category within their common active testing methodologies like DAST.

ASession initiation testingCorrect

"Session initiation testing" is not a distinct, commonly defined category or specific technique listed in OWASP's primary recommendations for active software security testing, such as those found in the OWASP Testing Guide or ASVS. While session management is tested, "session initiation" isn't a recognized separate test type.

BInput validation testing

Input validation testing is a critical part of active security testing to identify vulnerabilities like injection flaws (e.g., SQL injection, XSS) that arise from improper handling of user input, and is heavily emphasized by OWASP.

CTesting for error handling

Testing for error handling is important to ensure that applications do not leak sensitive information or expose system details through verbose or unhandled errors, which is a common OWASP recommendation.

DTesting for weak cryptography

Testing for weak cryptography involves assessing the strength of cryptographic implementations and algorithms used by an application to protect sensitive data, which is a standard security testing practice recommended by OWASP.

Concept tested: OWASP active security testing

Source: https://owasp.org/www-project-web-security-testing-guide/latest/

Topics

#OWASP#Application Security Testing#Dynamic Application Security Testing#Web Application Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCSP Practice