Which of the following statements is correct?

Question

BlackTom AI · Accepted Answer

Risk-based testing targets areas of highest impact and likelihood, so it can be used to detect security weaknesses introduced at the design level (for example, insecure authentication flows, missing input validation in the architecture, or risky data flows).

1) Relevant knowledge points and concepts
- Risk-based testing: identify and prioritize testing on features/components with the highest combination of risk (impact × likelihood). It can be applied during requirements and design reviews as well as implementation and test phases.
- Security at design level: many security faults originate from design decisions (e.g., insecure architectures, improper trust boundaries, weak threat models) and are not only coding errors.
- Types of static analysis: simple search-based tools (text or pattern matching) are less capable than full data/control-flow or semantic analyzers that reason about relationships in code.

2) Step-by-step reasoning
- Risk-based testing begins with a risk assessment of requirements and design artifacts.
- Based on that assessment, testers focus on high-risk design elements (authentication, authorization, data flows).
- By exercising or reviewing those design areas (threat modeling, misuse cases, design-level test cases), testers can uncover security issues before code implementation.
- Therefore, the statement that risk-based testing can identify security issues in the design level is valid.

3) Calculations
- None required.

4) Why the correct answer is correct
- Because risk-based testing explicitly includes analyzing and testing design-level artifacts to prioritize and detect potential security problems early; it is not limited to code-level defects.

5) Why other options are incorrect
- (a) Incorrect: Correctness and presence of security bugs are independent; software can be functionally correct yet have security vulnerabilities and still run.
- (b) Incorrect: A negative test that finds no fault does not prove absence of faults (testing shows presence but not absence of defects).
- (d) Incorrect: Simple search-based static analyzers (pattern searches) cannot reliably analyze relationships (data/control flow, interprocedural interactions) — that requires more advanced static analysis tools.

Conclusion: The correct choice is c. Final answer: c. Risk-based testing can identify security issues in the design level.

Which of the following statements is correct?单项选择题

类似问题

Testing involves

A function you have just made accepts only a single float or int as a input and performs a calculation. Which of the following set of test inputs, where each number is tested individually, is most likely to give you useful testing results?

Question at position 13 Why is virtualisation useful for testing software?It eliminates the need for developersIt allows apps to run directly on hardwareIt reduces software complexityIt ensures users can test without risk to the host systemClear my selection

Question at position 20 What is a key advantage of the V-Model in testing?It focuses only on GUI testingIt eliminates the need for documentationIt supports only waterfall methodsIt aligns testing activities with corresponding development stagesClear my selection

Question at position 19 Why is testing critical in system development?To prevent the use of agile methodsTo speed up hardware developmentTo replace user trainingTo reduce the cost of late-stage changesClear my selection

Question at position 18 What does testing involve in software development?Only validating visual design elementsOnly testing at final deployment stageEnsuring the system works at every stageTracking project budgetsClear my selection

Question at position 18 Why is testing critical in system development?To reduce the cost of late-stage changesTo replace user trainingTo prevent the use of agile methodsTo speed up hardware developmentClear my selection

Question at position 12 Which statement is TRUE about testing and quality?Good testing always guarantees project successTesting can help deliver quality but cannot guarantee successQuality does not depend on testingPoor test management rarely affects system qualityClear my selection

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单