Security testing basics in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding SQL Injection

Which of the following best describes what an SQL Injection attack is?

A An attack where malicious SQL code is inserted into input fields to manipulate the database.

B An attack that floods the server with too many requests to cause a denial of service.

C An attack that intercepts data packets between client and server to steal information.

D An attack that exploits weak passwords to gain unauthorized access.

💡 Hint

Think about how attackers might use input fields to harm databases.

SQL Injection involves inserting harmful SQL commands into input fields to trick the database into executing unintended commands.

❓ Predict Output

intermediate

Output of Security Test Log Filtering

Given the following Python code that filters security logs for failed login attempts, what will be the output?

Testing Fundamentals

logs = ["login success", "login failed", "password reset", "login failed"]
failed_attempts = [log for log in logs if "failed" in log]
print(len(failed_attempts))

A 1

B 3

C 0

D 2

💡 Hint

Count how many log entries contain the word 'failed'.

The list comprehension filters logs containing 'failed'. There are exactly two such entries, so the length is 2.

❓ assertion

advanced

Validating Password Complexity Assertion

Which assertion correctly checks that a password string contains at least one uppercase letter, one lowercase letter, and one digit?

A assert all(c.isupper() or c.islower() or c.isdigit() for c in password)

B assert password.isupper() and password.islower() and password.isdigit()

C assert any(c.isupper() for c in password) and any(c.islower() for c in password) and any(c.isdigit() for c in password)

D assert password.contains(uppercase) and password.contains(lowercase) and password.contains(digit)

💡 Hint

Check if at least one character of each type exists in the password.

Option C uses any() to verify presence of uppercase, lowercase, and digit characters. Other options are incorrect because they check all characters or use invalid methods.

🔧 Debug

advanced

Debugging Authentication Test Code

What error will this Python test code raise when run?

Testing Fundamentals

def test_login():
    username = "user1"
    password = "pass123"
    assert login(username, password) == True

def login(user, pwd):
    return user == "user1" and pwd == "pass1234"

A No error, test passes

B AssertionError

C NameError

D TypeError

💡 Hint

Check the password comparison in the login function.

The login function expects password 'pass1234' but test uses 'pass123', so assertion fails causing AssertionError.

❓ framework

expert

Choosing the Best Security Testing Framework Feature

Which feature is MOST important in a security testing framework to detect Cross-Site Scripting (XSS) vulnerabilities?

A Ability to inject and detect malicious scripts in web input fields

B Capability to perform load testing under heavy traffic

C Support for automated UI responsiveness testing

D Integration with version control systems for code commits

💡 Hint

Think about what XSS attacks do to web applications.

XSS attacks inject malicious scripts into web inputs. A framework that can inject and detect such scripts is essential for finding XSS vulnerabilities.