CV0-003 · Question #821
A company plans to publish a new application and must conform with security standards. Which of the following types of testing are MOST important for the systems administrator to run to assure the sec
The correct answer is B. Vulnerability testing E. Penetration testing. Before publishing an application, security and compliance assurance requires identifying known weaknesses and validating that those weaknesses can be actively exploited. Vulnerability testing and penetration testing together address both discovery and real-world exploitability.
Question
A company plans to publish a new application and must conform with security standards. Which of the following types of testing are MOST important for the systems administrator to run to assure the security and compliance of the application before publishing? (Choose two.)
Options
- ARegression testing
- BVulnerability testing
- CUsability testing
- DFunctional testing
- EPenetration testing
- FLoad testing
How the community answered
(40 responses)- A10% (4)
- B80% (32)
- C5% (2)
- D3% (1)
- F3% (1)
Why each option
Before publishing an application, security and compliance assurance requires identifying known weaknesses and validating that those weaknesses can be actively exploited. Vulnerability testing and penetration testing together address both discovery and real-world exploitability.
Regression testing verifies that new code changes have not broken existing functionality, which is a quality assurance concern rather than a security or compliance concern.
Vulnerability testing systematically scans an application for known security flaws such as misconfigurations, outdated libraries, and CVEs, which is essential for meeting compliance standards before release.
Usability testing evaluates the end-user experience and interface design, providing no security or compliance validation.
Functional testing confirms that application features behave according to specifications but does not assess the security posture or compliance of the application.
Penetration testing simulates real-world attacker techniques to actively exploit identified or unknown weaknesses, providing proof-of-exploitability evidence that is required by many security standards such as PCI-DSS and SOC 2.
Load testing measures application behavior and stability under high traffic conditions, addressing performance rather than security vulnerabilities or compliance requirements.
Concept tested: Pre-release security testing - vulnerability and penetration testing
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
Topics
Community Discussion
No community discussion yet for this question.