Which of the following statements is correct?

Question

BlackTom AI · Accepted Answer

Risk-based testing targets areas of highest impact and likelihood, so it can be used to detect security weaknesses introduced at the design level (for example, insecure authentication flows, missing input validation in the architecture, or risky data flows).

1) Relevant knowledge points and concepts
- Risk-based testing: identify and prioritize testing on features/components with the highest combination of risk (impact × likelihood). It can be applied during requirements and design reviews as well as implementation and test phases.
- Security at design level: many security faults originate from design decisions (e.g., insecure architectures, improper trust boundaries, weak threat models) and are not only coding errors.
- Types of static analysis: simple search-based tools (text or pattern matching) are less capable than full data/control-flow or semantic analyzers that reason about relationships in code.

2) Step-by-step reasoning
- Risk-based testing begins with a risk assessment of requirements and design artifacts.
- Based on that assessment, testers focus on high-risk design elements (authentication, authorization, data flows).
- By exercising or reviewing those design areas (threat modeling, misuse cases, design-level test cases), testers can uncover security issues before code implementation.
- Therefore, the statement that risk-based testing can identify security issues in the design level is valid.

3) Calculations
- None required.

4) Why the correct answer is correct
- Because risk-based testing explicitly includes analyzing and testing design-level artifacts to prioritize and detect potential security problems early; it is not limited to code-level defects.

5) Why other options are incorrect
- (a) Incorrect: Correctness and presence of security bugs are independent; software can be functionally correct yet have security vulnerabilities and still run.
- (b) Incorrect: A negative test that finds no fault does not prove absence of faults (testing shows presence but not absence of defects).
- (d) Incorrect: Simple search-based static analyzers (pattern searches) cannot reliably analyze relationships (data/control flow, interprocedural interactions) — that requires more advanced static analysis tools.

Conclusion: The correct choice is c. Final answer: c. Risk-based testing can identify security issues in the design level.

Which of the following statements is correct?Single choice

Similar Questions

Testing involves

A function you have just made accepts only a single float or int as a input and performs a calculation. Which of the following set of test inputs, where each number is tested individually, is most likely to give you useful testing results?

Question at position 13 Why is virtualisation useful for testing software?It eliminates the need for developersIt allows apps to run directly on hardwareIt reduces software complexityIt ensures users can test without risk to the host systemClear my selection

Question at position 20 What is a key advantage of the V-Model in testing?It focuses only on GUI testingIt eliminates the need for documentationIt supports only waterfall methodsIt aligns testing activities with corresponding development stagesClear my selection

Question at position 19 Why is testing critical in system development?To prevent the use of agile methodsTo speed up hardware developmentTo replace user trainingTo reduce the cost of late-stage changesClear my selection

Question at position 18 What does testing involve in software development?Only validating visual design elementsOnly testing at final deployment stageEnsuring the system works at every stageTracking project budgetsClear my selection

Question at position 18 Why is testing critical in system development?To reduce the cost of late-stage changesTo replace user trainingTo prevent the use of agile methodsTo speed up hardware developmentClear my selection

Question at position 12 Which statement is TRUE about testing and quality?Good testing always guarantees project successTesting can help deliver quality but cannot guarantee successQuality does not depend on testingPoor test management rarely affects system qualityClear my selection

More Practical Tools for Students Powered by AI Study Helper

Homework AI Solver

Stylized AI Paper Writer

Plagiarism Checker Assistant

Citation AI Academic Writing Tool

In-Class Translation Assistant

AI Note Generator

AI Quiz Answers

Past Exam Questions from University Test Bank

Smart Practice Assistant

Adaptive Practice

Making Your Study Simpler