nerdexam
(ISC)2

CISSP · Question #569

An application team is running tests to ensure that user entry fields will not accept invalid input of any length. What type of negative testing is this an example of?

The correct answer is C. Allowed number of characters. Negative testing for input fields that reject invalid data 'of any length' specifically targets character length validation, ensuring fields enforce limits on the number of characters accepted.

Submitted by carter_n· Mar 5, 2026Software Development Security

Question

An application team is running tests to ensure that user entry fields will not accept invalid input of any length. What type of negative testing is this an example of?

Options

  • AReasonable data
  • BPopulation of required fields
  • CAllowed number of characters
  • DSession testing

How the community answered

(42 responses)
  • B
    2% (1)
  • C
    95% (40)
  • D
    2% (1)

Why each option

Negative testing for input fields that reject invalid data 'of any length' specifically targets character length validation, ensuring fields enforce limits on the number of characters accepted.

AReasonable data

Reasonable data testing focuses on whether the application accepts or rejects data that is logically plausible or implausible in content (e.g., entering a negative age), not specifically on the length of the input.

BPopulation of required fields

Population of required fields testing verifies that the application enforces mandatory field completion and rejects form submission when required fields are left blank, which is unrelated to input length validation.

CAllowed number of charactersCorrect

Testing that user entry fields will not accept invalid input 'of any length' directly maps to 'allowed number of characters' negative testing, which validates that input fields enforce minimum and maximum character length constraints. This type of test verifies boundary conditions for field length, ensuring the application rejects input that exceeds or falls below defined character limits. It is a form of negative testing because it confirms the system correctly handles out-of-bound length inputs rather than valid ones.

DSession testing

Session testing evaluates the security and behavior of user sessions, such as session timeout, session hijacking prevention, or concurrent session handling, which is unrelated to validating the length of user input fields.

Concept tested: Negative testing for input field character length validation

Source: https://www.istqb.org/certifications/certified-tester-foundation-level

Topics

#Negative testing#Input validation#Software testing#Application security

Community Discussion

No community discussion yet for this question.

Full CISSP Practice