CV0-003 · Question #483
A company is required to ensure all access to its cloud instance for all users to utilize two-factor authentication. The QA team confirms all functional requirements successfully test. After…
The correct answer is C. The QA team only tested functional requirements. The QA team verified that 2FA functionality works but did not test whether the enforcement policy was applied to all user types, missing a non-functional requirement. Non-functional and policy enforcement requirements must be explicitly tested beyond functional correctness.
Question
A company is required to ensure all access to its cloud instance for all users to utilize two-factor authentication. The QA team confirms all functional requirements successfully test. After deployment, all business users report the two-factor authentication is not enforced while accessing the instance. Which of the following would be the MOST likely reason the QA team did not catch the issue?
Options
- AThe business users are using the wrong hardware token to log in.
- BThe administrator configured to use two-factor authentication by default.
- CThe QA team only tested functional requirements.
- DThe business users are accessing the instance located in their country.
How the community answered
(43 responses)- A26% (11)
- B12% (5)
- C58% (25)
- D5% (2)
Why each option
The QA team verified that 2FA functionality works but did not test whether the enforcement policy was applied to all user types, missing a non-functional requirement. Non-functional and policy enforcement requirements must be explicitly tested beyond functional correctness.
Hardware token misuse is a user error scenario unrelated to a QA team's failure to detect a missing enforcement policy during structured testing.
Configuring 2FA as the default would increase enforcement rather than reduce it, so this option would not explain why business users bypass 2FA.
Functional testing confirms that a feature behaves as designed under normal test conditions, but it does not validate whether access policies are correctly enforced across all user roles and groups in production. The enforcement of 2FA for business users is a non-functional policy requirement that requires separate security or compliance testing to verify it is applied consistently to every user population.
Geographic access location has no bearing on whether the QA team identified a gap in 2FA enforcement policy during testing.
Concept tested: Non-functional policy enforcement testing in cloud security
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.