A security tester discovers that the login endpoint accepts a SQL injection payload that returns a valid session without valid credentials. Which finding description is the most appropriate for a security test report?
A professional security finding includes OWASP classification, exact location, reproducible evidence, CVSS score, and a concrete recommendation.
Options A, B, and D identify the issue but lack structure — they cannot be used to triage, prioritise, or reproduce the finding in isolation. Option C follows the industry-standard security finding format: OWASP category and ID (A03:2021), the exact vulnerable endpoint and parameter, the specific payload used with the observed response, the CVSS score for risk quantification, and a targeted remediation recommendation. This structure allows any developer or security engineer to locate, reproduce, and fix the issue from the report alone.
Key vocabulary:
• SQL Injection — insertion of malicious SQL code into a query via unsanitised user input
• OWASP A03:2021 — the Injection category in the OWASP Top 10 (2021 edition)
• CVSS Base Score — Common Vulnerability Scoring System; 0–10 scale for severity quantification
• Parameterised statement — a prepared SQL query where user input is passed as a parameter, not embedded
• Session token — a credential that grants authenticated access; must never be obtainable without valid login
2 / 10
A security finding has a CVSS Base Score of 7.5. How should this be classified and communicated in a security test report?
A CVSS score of 7.5 falls in the High range (7.0–8.9) — not Critical, not Medium.
Option A is wrong: Critical severity requires a CVSS score of 9.0–10.0; 7.5 does not meet this threshold. Option B is wrong: Medium is 4.0–6.9; 7.5 exceeds it. Option C is wrong: CVSS is not a percentage — it is a structured formula combining Base, Temporal, and Environmental metrics. Option D correctly applies the CVSS severity scale: High (7.0–8.9), describes the exploitability characteristics implied by a 7.5 score (network, no auth, high impact), and gives a realistic remediation timeline used in enterprise security programmes.
Key vocabulary:
• CVSS (Common Vulnerability Scoring System) — an industry-standard formula for scoring vulnerability severity
• Critical — CVSS 9.0–10.0; immediate remediation required
• High — CVSS 7.0–8.9; remediation within 7–14 days
• Medium — CVSS 4.0–6.9; remediation within 30 days
• Low — CVSS 0.1–3.9; addressed in regular maintenance cycles
3 / 10
An AppSec engineer explains that they run a tool that analyses source code, bytecode, or binaries without executing the application, detecting potential vulnerabilities early in the CI pipeline. This practice is called:
SAST analyses code without running it; DAST tests the running application; IAST instruments the running app from inside.
DAST tools (like OWASP ZAP or Burp Suite) send requests to the live application and analyse responses — they see the app as an attacker would. IAST agents (like Contrast Security) run inside the application JVM/runtime and detect vulnerabilities during functional or integration test execution. Penetration testing is a manually-directed engagement, not an automated pipeline tool. Only SAST (like SonarQube, Checkmarx, Semgrep) analyses source code without execution, making it suitable for early CI integration before deployment.
Key vocabulary:
• SAST — Static Application Security Testing; code-level analysis without execution
• DAST — Dynamic Application Security Testing; testing the running application externally
• IAST — Interactive Application Security Testing; runtime analysis via internal instrumentation
• CI pipeline — the automated build, test, and analysis workflow triggered on each commit
• Instrumentation agent — a component embedded in the application runtime that monitors code execution
4 / 10
A security consultant is writing up a penetration testing finding for a reflected XSS vulnerability. Which structure is the most professional and complete?
A penetration testing finding must include a precise title, CVSS score, affected endpoint, reproducible evidence, impact statement, and specific remediation guidance.
Options A, B, and C each omit critical elements: A has no evidence or CVSS; B has no score, endpoint, or evidence; C has no score, endpoint, or specific remediation. Option D meets the full industry standard: it names the finding type precisely, assigns a CVSS severity, identifies the exact endpoint and parameter, provides a reproducible proof-of-concept payload, lists concrete impact categories, and gives targeted remediation steps — both the developer fix (entity encoding) and the security control (CSP header).
Key vocabulary:
• Reflected XSS — a cross-site scripting attack where the payload is reflected from the server in the same request
• Proof of concept (PoC) — a working exploit or payload that demonstrates the vulnerability is exploitable
• HTML entity encoding — converting special characters to HTML entities to prevent script injection
• Content-Security-Policy (CSP) — an HTTP header that restricts what scripts and resources a page may load
• Session hijacking — stealing a user's authenticated session token to impersonate them
5 / 10
A security team is defining the scope for a web application penetration test. Which scope definition is the most professional?
A penetration test scope must explicitly list in-scope and out-of-scope targets, environments, and any third-party restrictions.
Option A is dangerously vague — "entire application" without boundaries creates legal and operational risk. Option B is reckless: testing production servers and endpoints without explicit authorisation and staging-only restrictions is irresponsible. Option D is too narrow and unexplained. Option C is the professional standard: it specifies exact URLs, restricts activity to the staging environment (protecting production), excludes named third-party services (Stripe, CDN) that require separate authorisation, and excludes the mobile app as a distinct engagement — providing clear legal and operational boundaries for the testing team.
Key vocabulary:
• Scope of engagement — the formally agreed boundaries of a security testing activity
• Out-of-scope — explicitly excluded targets; testing against them without authorisation is illegal
• Third-party service — an external system (payment processor, CDN) requiring its own authorisation to test
• Staging environment — a pre-production copy of the system; preferred for destructive security testing
• Rules of engagement — the agreed constraints on timing, methods, and targets for a penetration test
6 / 10
Sarah, a QA engineer, is reviewing a pull request for a new user registration endpoint. The PR description mentions 'input validation' but doesn't elaborate. Which of the following questions would be most appropriate to ask the developer to ensure robust security testing? curl -i https://api.example.com/register --data 'username=testuser&password=secret123'
Sarah needs to delve deeper than just the initial description. Asking about specific validation rules directly addresses potential vulnerabilities like SQL injection or XSS – common attack vectors during user registration. Rate limiting and vulnerability scans are important but should be prompted after confirming the core input sanitization is in place. The 'Insufficient' option demonstrates a lack of proactive security questioning.
7 / 10
During a Slack conversation with the development team regarding a recent security finding – a potential CSRF vulnerability identified through automated scanning – David states: 'Yeah, it's a high CVSS score. We should probably just fix it and move on.' Which of the following is the MOST accurate response to David's statement? GET /user/profile
David misunderstands the significance of CVSS scores. While a higher score indicates greater potential impact, it doesn't negate the need for investigation and remediation. The core purpose of CVSS is to provide a standardized measure of vulnerability severity to guide prioritization. Prioritizing solely on CVSS can lead to overlooking vulnerabilities with high impact but lower prevalence.
8 / 10
Mark, a security engineer, is documenting a finding related to insecure deserialization. He writes: 'The application uses JSON parsing to handle user input and allows arbitrary objects to be deserialized, potentially leading to remote code execution.' Which of the following best describes Mark's approach to this finding? JSON.parse(userInput)
Mark correctly identifies the severity of insecure deserialization – a common and dangerous vulnerability. Allowing arbitrary object deserialization can lead to remote code execution (RCE). The correct response is to acknowledge it as a critical issue needing immediate attention and potentially a code rewrite. Whitelisting isn't sufficient, simply stating it's 'safe' is incorrect, and ignoring the finding is irresponsible.
9 / 10
Lisa, a security analyst, is drafting a PR description for a newly discovered API endpoint that allows users to upload images. The description needs to clearly communicate the potential risks associated with this functionality. Which of the following statements would be MOST effective? GET /api/images
Lisa's description needs to explicitly highlight the risks associated with image uploads – a frequent target for attacks like shellcode injection. The most effective statement details the necessary security controls: size limits, content type checks, and virus scanning. Simply stating it allows images is insufficient; failing to mention specific risks demonstrates a lack of understanding.
10 / 10
During a standup meeting, Alex reports: 'I found a potential authentication bypass in the legacy system. It's related to how sessions are handled.' Which of the following actions should Alex immediately prioritize? sessionID = request.getSession().getId()
An authentication bypass is a critical security vulnerability requiring immediate attention. Alex should prioritize escalation to ensure the security team takes prompt action to contain the risk and prevent further exploitation. Reproducing and analyzing are important steps but shouldn't delay initial containment. Ignoring it is completely unacceptable.
This exercise, "Security Testing Language", tests your understanding of testing & qa lab vocabulary and phrasing through 10 multiple-choice questions drawn from real workplace scenarios.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 10 questions. Each one presents a realistic sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Who is this Testing & QA Lab exercise for?
It's designed for IT professionals and learners who want to sound natural discussing testing & qa lab topics in English — useful for meetings, documentation, interviews, and day-to-day communication with English-speaking teams.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more Testing & QA Lab exercises?
Browse the full Testing & QA Lab exercises hub for more practice, or explore other exercise categories covering vocabulary, grammar, interviews, and workplace communication.