Questions to be answered:
1. If you could only choose one type of testing to perform on your application, which type would it be and why?
-
Which type of testing do you think would be the fastest?Why?
-
Which type of testing do you think would be the slowest? Why?
-
What types of vulnerabilities would you want to look for in regression testing? Name at least two, and why you chose each one.
-
Does your workplace have a zero-trust network design? If you don’t know the answer, your homework is to find out.
-
Does your workplace allow use of a CI/CD pipeline? If you don’t know the answer, your homework is to find out.
-
In a CI/CD environment, should you implement a Static Application Security Testing (SAST) tool and run a complete scan of all of the code, every time there is a new build? Why? Why not?
-
Why is it critical to put all new changes into a code repository?
-
Why do we test integration points between different systems? Is it more or less valuable than testing the rest of each system?
-
Why do we test databases, even though they aren’t publicly accessible?
-
Why do we test APIs, even though they aren’t publicly accessible? (This might be a trick question.)
-
When does it make sense to do a penetration test versus a security assessment of a system? Explain your answer.
Buy the book https://www.amazon.ca/Alice-Bob-Learn-Application-Security/dp/1119687357
Take the course: https://academy.wehackpurple.com/