CSSLP · Question #373
A payment technology company called Northbridge Systems deploys updates to its customer portal and the security team must run tests. What is the primary goal of regression testing during security…
The correct answer is C. To verify that recent code changes do not introduce defects into existing features. During security assessments, regression testing's main objective is to ensure that new code deployments or updates do not inadvertently introduce new vulnerabilities or break existing security controls. It confirms the integrity of the system's security posture after changes.
Question
A payment technology company called Northbridge Systems deploys updates to its customer portal and the security team must run tests. What is the primary goal of regression testing during security assessments?
Options
- ATo use automated scanners to detect vulnerabilities
- BTo confirm that security patches have not reintroduced previously fixed flaws
- CTo verify that recent code changes do not introduce defects into existing features
- DTo validate cryptographic implementations and algorithm usage
How the community answered
(43 responses)- A2% (1)
- B2% (1)
- C91% (39)
- D5% (2)
Why each option
During security assessments, regression testing's main objective is to ensure that new code deployments or updates do not inadvertently introduce new vulnerabilities or break existing security controls. It confirms the integrity of the system's security posture after changes.
Using automated scanners to detect vulnerabilities is a method or tool used in security testing, but not the overarching goal of regression testing itself, which is focused on the impact of changes.
While confirming that security patches have not reintroduced previously fixed flaws is a valid and important security regression test, option C is a broader and more fundamental definition of regression testing, encompassing all types of defects (including re-introduced flaws) across all existing features impacted by changes.
The primary goal of regression testing during security assessments is to verify that recent code changes do not introduce new defects, including security vulnerabilities, into existing features or functionalities. This ensures that the application's overall security posture remains stable and that modifications have not inadvertently created new weaknesses or broken previously secure components.
Validating cryptographic implementations and algorithm usage is a specialized form of security testing (cryptographic analysis), not the general primary goal of regression testing, which focuses on the impact of changes on existing functionality.
Concept tested: Security regression testing
Topics
Community Discussion
No community discussion yet for this question.