nerdexam
(ISC)2

CISSP · Question #1522

Drag and Drop Question A software security engineer is developing a black box-based test plan that will measure the system's reaction to incorrect or illegal inputs or unexpected operational errors…

The correct answer is Equivalence Class Analysis; Boundary Value Analysis; Decision Table Analysis; State-Based Analysis. Black Box Testing Techniques - Drag & Drop Explained Context The scenario describes black box testing focused on how a system handles bad inputs, illegal data, and unexpected situations. The techniques are ordered by their logical application in a test design workflow - from…

Submitted by cyberguy42· Mar 5, 2026Software Development Security

Question

Drag and Drop Question A software security engineer is developing a black box-based test plan that will measure the system's reaction to incorrect or illegal inputs or unexpected operational errors and situations. Match the functional testing techniques on the left with the correct input parameters on the right. Answer:

Exhibit

CISSP question #1522 exhibit

Answer Area

Drag items

State-Based AnalysisEquivalence Class AnalysisDecision Table AnalysisBoundary Value Analysis

Correct arrangement

  • Equivalence Class Analysis
  • Boundary Value Analysis
  • Decision Table Analysis
  • State-Based Analysis

Explanation

Black Box Testing Techniques - Drag & Drop Explained

Context

The scenario describes black box testing focused on how a system handles bad inputs, illegal data, and unexpected situations. The techniques are ordered by their logical application in a test design workflow - from basic input partitioning to complex behavioral modeling.


Correct Arrangement & Reasoning

1. Equivalence Class Analysis

Foundation: partition the input space

The starting point. You divide all possible inputs into equivalence classes - groups where the system should behave identically. Critically, this includes invalid classes (illegal/incorrect inputs). Testing one value from each class is sufficient to represent the whole group.

  • Why first? You must define what input domains exist before you can test their edges or combinations.

2. Boundary Value Analysis

Refinement: test the edges of those classes

Once equivalence classes exist, you test at their boundaries (min, max, just-above, just-below). Most defects occur at the border between valid and invalid input ranges.

  • Why second? It directly extends equivalence class analysis - you need the class boundaries defined before you can test them.
  • Common mistake: Treating BVA as independent of equivalence classes. They are complementary; BVA is a refinement of ECA.

3. Decision Table Analysis

Complexity: test combinations of conditions

When system behavior depends on multiple simultaneous conditions, decision tables map every combination of inputs to expected outputs/actions. Catches defects in logic involving AND/OR conditions.

  • Why third? After individual inputs and boundaries are handled, you address interaction effects between inputs.
  • Common mistake: Using decision tables for simple single-variable inputs - overkill there; they shine with multi-condition logic.

4. State-Based Analysis

Behavior: test system reactions across states

Tests how the system transitions between states in response to events - including unexpected operational errors and illegal sequences. Verifies the system doesn't enter invalid states.

  • Why last? It models system behavior over time, not just input/output pairs. It addresses the "unexpected operational errors and situations" part of the prompt directly.
  • Common mistake: Confusing this with decision tables - decision tables test conditions -> actions; state-based testing tracks the system's current state as a variable itself.

Summary Table

OrderTechniqueWhat It Tests
1Equivalence Class AnalysisValid/invalid input groups
2Boundary Value AnalysisEdges between those groups
3Decision Table AnalysisMulti-condition combinations
4State-Based AnalysisState transitions & unexpected events

The progression moves from simple input partitioning -> edge cases -> combinatorial logic -> stateful behavior, mirroring how a rigorous black box test plan is typically designed.

Topics

#Software Testing#Black Box Testing#Functional Testing#Application Security

Community Discussion

No community discussion yet for this question.

Full CISSP Practice