Security testing tools overview in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identify the primary purpose of OWASP ZAP

OWASP ZAP is a popular security testing tool. What is its main use?

A Automated vulnerability scanning for web applications

B Performance testing of mobile apps

C Load testing of network servers

D Code coverage analysis for unit tests

💡 Hint

Think about tools that find security holes in websites automatically.

OWASP ZAP is designed to scan web applications for security vulnerabilities automatically.

❓ Predict Output

intermediate

What output does this Burp Suite scan summary produce?

Given a Burp Suite scan that finds 3 high, 5 medium, and 2 low severity issues, what is the correct summary output?

Testing Fundamentals

scan_summary = {
  'high': 3,
  'medium': 5,
  'low': 2
}
print(f"High: {scan_summary['high']}, Medium: {scan_summary['medium']}, Low: {scan_summary['low']}")

A High: 2, Medium: 3, Low: 5

B High: 5, Medium: 3, Low: 2

C High: 3, Medium: 5, Low: 2

D High: 3, Medium: 2, Low: 5

💡 Hint

Check the dictionary keys and values carefully.

The print statement outputs the values exactly as stored in the dictionary for each severity level.

❓ assertion

advanced

Which assertion correctly verifies a SQL injection vulnerability found by sqlmap?

You run sqlmap and want to assert that a vulnerability was found in your test script. Which assertion is correct?

Testing Fundamentals

vulnerabilities = ['XSS', 'SQL Injection', 'CSRF']
# Assertion here

A assert vulnerabilities == 'SQL Injection'

B assert 'sql injection' in vulnerabilities

C assert vulnerabilities.contains('SQL Injection')

D assert 'SQL Injection' in vulnerabilities

💡 Hint

Check Python syntax for membership testing.

Option D correctly uses Python's 'in' keyword to check if 'SQL Injection' is in the list.

🔧 Debug

advanced

Find the error in this script using Nikto scanner output parsing

This Python snippet tries to parse Nikto output but fails. What is the error?

Testing Fundamentals

nikto_output = 'Nikto scan report: No vulnerabilities found'
if nikto_output.find('vulnerabilities') != -1:
    print('Issues detected')
else:
    print('No issues')

A The if condition is wrong; find() returns -1 if not found, which is truthy

B The print statements are reversed

C Nikto output string is empty, causing error

D The find() method should be replaced with index()

💡 Hint

Remember how Python treats 0 and -1 in conditions.

find() returns -1 if substring not found, which is truthy, so the if condition wrongly triggers.

❓ framework

expert

Which security testing framework supports automated API vulnerability scanning?

Among these frameworks, which one is designed for automated API security testing?

A JUnit

B OWASP ZAP

C Selenium

D JMeter

💡 Hint

Think about tools focused on security, not just testing or load.

OWASP ZAP supports automated API vulnerability scanning, unlike the others which focus on unit, UI, or load testing.