nerdexam
(ISC)2

CSSLP · Question #373

A payment technology company called Northbridge Systems deploys updates to its customer portal and the security team must run tests. What is the primary goal of regression testing during security…

The correct answer is C. To verify that recent code changes do not introduce defects into existing features. During security assessments, regression testing's main objective is to ensure that new code deployments or updates do not inadvertently introduce new vulnerabilities or break existing security controls. It confirms the integrity of the system's security posture after changes.

Secure Software Testing

Question

A payment technology company called Northbridge Systems deploys updates to its customer portal and the security team must run tests. What is the primary goal of regression testing during security assessments?

Options

  • ATo use automated scanners to detect vulnerabilities
  • BTo confirm that security patches have not reintroduced previously fixed flaws
  • CTo verify that recent code changes do not introduce defects into existing features
  • DTo validate cryptographic implementations and algorithm usage

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    91% (39)
  • D
    5% (2)

Why each option

During security assessments, regression testing's main objective is to ensure that new code deployments or updates do not inadvertently introduce new vulnerabilities or break existing security controls. It confirms the integrity of the system's security posture after changes.

ATo use automated scanners to detect vulnerabilities

Using automated scanners to detect vulnerabilities is a method or tool used in security testing, but not the overarching goal of regression testing itself, which is focused on the impact of changes.

BTo confirm that security patches have not reintroduced previously fixed flaws

While confirming that security patches have not reintroduced previously fixed flaws is a valid and important security regression test, option C is a broader and more fundamental definition of regression testing, encompassing all types of defects (including re-introduced flaws) across all existing features impacted by changes.

CTo verify that recent code changes do not introduce defects into existing featuresCorrect

The primary goal of regression testing during security assessments is to verify that recent code changes do not introduce new defects, including security vulnerabilities, into existing features or functionalities. This ensures that the application's overall security posture remains stable and that modifications have not inadvertently created new weaknesses or broken previously secure components.

DTo validate cryptographic implementations and algorithm usage

Validating cryptographic implementations and algorithm usage is a specialized form of security testing (cryptographic analysis), not the general primary goal of regression testing, which focuses on the impact of changes on existing functionality.

Concept tested: Security regression testing

Topics

#Regression testing#Security testing#Vulnerability prevention#Code changes

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice