Why security testing protects users in Testing Fundamentals - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is security testing important for users?

Choose the best reason why security testing helps protect users of software applications.

A It ensures the software has no spelling mistakes in the user interface.

B It improves the software's speed and performance for users.

C It checks if the software's colors and fonts are user-friendly.

D It finds vulnerabilities that attackers could exploit to steal user data.

💡 Hint

Think about what could happen if attackers find weak spots in software.

Security testing identifies weaknesses that could let attackers access or steal user information, protecting users from harm.

❓ Predict Output

intermediate

Output of a security test log analysis

What is the output of this simple security test log filter code?

Testing Fundamentals

logs = ["INFO: User login successful", "WARNING: Password attempt failed", "ERROR: SQL injection detected", "INFO: Data saved"]
security_alerts = [log for log in logs if 'ERROR' in log or 'WARNING' in log]
print(security_alerts)

A ["WARNING: Password attempt failed", "ERROR: SQL injection detected"]

B ["INFO: User login successful", "INFO: Data saved"]

C ["ERROR: SQL injection detected"]

D []

💡 Hint

Look for logs containing 'ERROR' or 'WARNING'.

The code filters logs to include only those with 'ERROR' or 'WARNING', so it outputs those two messages.

❓ assertion

advanced

Correct assertion for checking user password encryption

Which assertion correctly verifies that a user's password is stored encrypted (not plain text)?

Testing Fundamentals

def test_password_encryption(user_password, stored_password):
    # user_password is plain text input
    # stored_password is what is saved in database
    pass  # Fill in assertion here

A assert stored_password.startswith('plain:')

B assert user_password == stored_password

C assert user_password != stored_password

D assert stored_password == ''

💡 Hint

Encrypted passwords should not match the plain text password.

The assertion checks that the stored password is different from the plain text input, meaning it is encrypted.

🔧 Debug

advanced

Find the error in this security test code

Identify the error in this code snippet that tests if a user input is sanitized to prevent XSS attacks.

Testing Fundamentals

def test_input_sanitization(user_input):
    sanitized = sanitize(user_input)
    assert '<script>' not in sanitized
    assert '<script>' not in sanitized

A The first assertion should check sanitized, not user_input.

B The sanitize function is missing parentheses.

C The assertions should use 'in' instead of 'not in'.

D The function should return sanitized value.

💡 Hint

Check which variable should be free of script tags after sanitization.

The first assertion wrongly checks the original input instead of the sanitized output; it should check sanitized only.

❓ framework

expert

Best practice for integrating security tests in CI/CD pipeline

Which option describes the best way to include security testing in a continuous integration/continuous deployment (CI/CD) pipeline?

A Run manual security tests only when users report issues.

B Run automated security tests during the build phase before deployment.

C Run automated security tests after deployment to production only.

D Skip security tests to speed up deployment.

💡 Hint

Think about catching security issues early before software reaches users.

Running automated security tests during the build phase helps catch vulnerabilities early, preventing unsafe code from deploying.