Exam CS0-002 topic 1 question 139 discussion

Security regression testing is a type of testing that is designed to ensure that changes to an application or system do not introduce new security vulnerabilities. It involves rerunning security tests that were previously performed on the application or system to verify that the security controls are still effective and that no new vulnerabilities have been introduced.

Here are my thoughts: A. Input validation is just a one of many secure coding practices. B. Security regression happens AFTER a change has been made to test the apps function. C. Application fuzzing automates the discovery of security and coding mistakes. D. User acceptance is more about functionality and fit for purpose. E. Stress testing won't necessarily test for secure coding. I'll go with C. "Threat actors use fuzzing to find zero-day exploits – this is known as a fuzzing attack. Security professionals, on the other hand, leverage fuzzing techniques to assess the security and stability of applications." https://brightsec.com/blog/fuzzing/

Security regression testing is designed to ensure that new code or updates do not introduce new vulnerabilities and that existing security features remain effective. This type of testing helps verify that the development team is adhering to secure coding practices, as outlined in the SLA, by checking for security flaws consistently throughout the development process.

B. Security regression testing Explanation: Security regression testing involves systematically retesting a software application to ensure that new code changes have not introduced security vulnerabilities or weaknesses. This type of testing helps identify any unintended security issues that may arise as a result of modifications to the code.

B. Security regression testing Security regression testing involves systematically retesting a software application to ensure that any recent changes or updates have not introduced new security vulnerabilities or negatively impacted existing security measures.

Got to go with C for this one. At the end of the day while it's an awkwardly worded question user acceptance testing is not a code review technique. Security regression testing is out since this is a new application, not one having changes made, input validation is too specific and stress testing is just irrelevant to the question.

CHATGPT assumed the same... the company is outsourcing an existing application hence, security regression

Security regression testing is a type of testing that is performed to ensure that changes to an application do not introduce new security vulnerabilities. This is done by re-testing the application for security vulnerabilities after each change is made.

The company started the code with industry best practices for secure coding in mind and its outsourcing it wanting to make sure the third party follows tthe original secure coding practices and nothing is changed on security just work on the code and finish it because the original company dont have the time to do the trivia work that takes long time. They will insure you the best practices and you follow their steps and they make sure you didnt change anything so original company should do B. Security regression testing

The best way to verify if the third-party development team is following industry best practices for secure coding, based on the SLA, would be to conduct security regression testing (option B). Security regression testing involves retesting the application to ensure that any security vulnerabilities or weaknesses that were previously identified have been resolved and that new vulnerabilities have not been introduced during the development process. It helps to verify that the secure coding practices and measures are being implemented effectively.

I'm choosing c, User acceptance doesn't have nothing to do with the SLA and best code practice, this is "testing the application by its intended audience, option B security regression you do it after you patch it, no make sure there is not vulnerabilities and everything has been solved (last step), and input validation is not even an option

Tough security regression if they are making changes to the application. And fuzzing if it’s the first version of the application. I cant tell what the question is asking for unfortunately

come on guys

From a security point of view Fuzzing seems to make the most sense

Input validation is included in secure coding best practices.

The best way to verify that the third-party development team is following industry best practices for secure coding is to conduct security regression testing. This type of testing involves retesting a previously tested application after modifying or updating it to ensure that the changes have not introduced any new vulnerabilities or security issues. By conducting security regression testing, the company can verify that the development team is following industry best practices for secure coding and that the application is secure. Other testing methods, such as input validation, application fuzzing, user acceptance testing, and stress testing, may also be useful in ensuring the security of the application, but are not specifically focused on verifying that the development team is following industry best practices for secure coding.

Answer is C the question states that according to the SLA, the 3rd party must comply with industry standard rules , so after that, we can forget about the SLA itself, industry standard is across the board for everyone. If it had stated specifically in the SLA that the company requires x,y,z , then you could consider userr acceptance testing. What Is Fuzzing? Fuzzing or fuzz testing is a dynamic application security testing technique for negative testing. Fuzzing aims to detect known, unknown, and zero-day vulnerabilities