OFFICIAL (ISC)² CSSLP - DOMAIN 5: SECURE
SOFTWARE TESTING
Attack surface validation CORRECT ANSWER Determining if the software has
exploitable weakness (attack surface).
Black box test CORRECT ANSWER Usually described as focusing on testing functional
requirements.
Functional testing CORRECT ANSWER Software testing is performed primarily to attest
to the functionality of the software as expected by the business or customer.
Fuzz testing CORRECT ANSWER A software testing technique, often automated or
semi- automated, that involves providing invalid, unexpected, or random data to the
inputs of a computer program.
Load testing CORRECT ANSWER Usually defined as the process of exercising the
system under test by feeding it the largest tasks it can operate with.
Penetration test (pen test) CORRECT ANSWER A validation and verification measure
that is an evaluation of a software or network's current state of security
Pseudo Random Number Generator (PRNG) CORRECT ANSWER A deterministic
algorithm to generate a sequence of numbers with little or no discernible pattern in the
numbers, except for broad statistical properties.
Regression Test CORRECT ANSWER Performed on existing operational software to
verify that existing functionality didn't break when other aspects of the environment are
changed; it is advisable to have a library of tests that you would run in each regression
test.
Test case CORRECT ANSWER Answers the question, "What am I going to test?"
Normally consists of a unique identifier, requirement references from a design
specification, preconditions, events, a series of steps (also known as actions) to follow,
input, output, expected result, and actual result.
Test harness CORRECT ANSWER The software, tools, samples of data input and
output, and configurations.
Test plan CORRECT ANSWER A document detailing a systematic approach to testing
a system such as a machine or software.
Test script CORRECT ANSWER A procedure or programing code that replicates user
actions. Initially, the term was derived from the product of work created by automated
regression test tools.
