nerdexam
CompTIA

CV0-003 · Question #821

A company plans to publish a new application and must conform with security standards. Which of the following types of testing are MOST important for the systems administrator to run to assure the sec

The correct answer is B. Vulnerability testing E. Penetration testing. Before publishing an application, security and compliance assurance requires identifying known weaknesses and validating that those weaknesses can be actively exploited. Vulnerability testing and penetration testing together address both discovery and real-world exploitability.

Security

Question

A company plans to publish a new application and must conform with security standards. Which of the following types of testing are MOST important for the systems administrator to run to assure the security and compliance of the application before publishing? (Choose two.)

Options

  • ARegression testing
  • BVulnerability testing
  • CUsability testing
  • DFunctional testing
  • EPenetration testing
  • FLoad testing

How the community answered

(40 responses)
  • A
    10% (4)
  • B
    80% (32)
  • C
    5% (2)
  • D
    3% (1)
  • F
    3% (1)

Why each option

Before publishing an application, security and compliance assurance requires identifying known weaknesses and validating that those weaknesses can be actively exploited. Vulnerability testing and penetration testing together address both discovery and real-world exploitability.

ARegression testing

Regression testing verifies that new code changes have not broken existing functionality, which is a quality assurance concern rather than a security or compliance concern.

BVulnerability testingCorrect

Vulnerability testing systematically scans an application for known security flaws such as misconfigurations, outdated libraries, and CVEs, which is essential for meeting compliance standards before release.

CUsability testing

Usability testing evaluates the end-user experience and interface design, providing no security or compliance validation.

DFunctional testing

Functional testing confirms that application features behave according to specifications but does not assess the security posture or compliance of the application.

EPenetration testingCorrect

Penetration testing simulates real-world attacker techniques to actively exploit identified or unknown weaknesses, providing proof-of-exploitability evidence that is required by many security standards such as PCI-DSS and SOC 2.

FLoad testing

Load testing measures application behavior and stability under high traffic conditions, addressing performance rather than security vulnerabilities or compliance requirements.

Concept tested: Pre-release security testing - vulnerability and penetration testing

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf

Topics

#vulnerability testing#penetration testing#compliance#security assurance

Community Discussion

No community discussion yet for this question.

Full CV0-003 Practice