CV0-002 · Question #483
A company is required to ensure all access to its cloud instance for all users to utilize two-factor authentication. The QA team confirms all functional requirements successfully test. After deploymen
The correct answer is C. The QA team only tested functional requirements.. The most likely reason the QA team failed to identify that two-factor authentication was not enforced is that their testing scope was limited to functional requirements, neglecting security non-functional requirements.
Question
A company is required to ensure all access to its cloud instance for all users to utilize two-factor authentication. The QA team confirms all functional requirements successfully test. After deployment, all business users report the two-factor authentication is not enforced while accessing the instance. Which of the following would be the MOST likely reason the QA team did not catch the issue?
Options
- AThe business users are using the wrong hardware token to log in.
- BThe administrator configured to use two-factor authentication by default.
- CThe QA team only tested functional requirements.
- DThe business users are accessing the instance located in their country.
How the community answered
(26 responses)- A8% (2)
- B8% (2)
- C65% (17)
- D19% (5)
Why each option
The most likely reason the QA team failed to identify that two-factor authentication was not enforced is that their testing scope was limited to functional requirements, neglecting security non-functional requirements.
The type of hardware token used by business users is irrelevant if the system is not enforcing two-factor authentication at all.
If the administrator configured MFA by default, then the issue would be that it wasn't enforced, contradicting the premise that it should have been configured. This choice doesn't explain why QA missed it.
If the QA team only tested functional requirements, they would have focused on whether the system performed its intended operations, potentially overlooking non-functional security requirements like mandatory two-factor authentication enforcement. This oversight in testing scope would explain why the issue was not caught before deployment.
The geographical location of business users accessing the instance is generally irrelevant to whether two-factor authentication is enforced or not.
Concept tested: QA scope for security requirements
Topics
Community Discussion
No community discussion yet for this question.