CYBERSECURITY-ARCHITECTURE-AND-ENGINEERING practice question 3 of 30

The DevSecOps team for an organization manages a continuous integration and continuous deployment (CI/CD) pipeline for a three-tier web application…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Cybersecurity Principles

The DevSecOps team for an organization manages a continuous integration and continuous deployment (CI/CD) pipeline for a three-tier web application. Management has asked the team toperform a series of comprehensive post-deployment tests to make sure that all of the components of the application can interact and function properly. What should the team recommend?

Answer options

Correct Answer:

Explanation

The request is for a post-deployment test to ensure all application components can "interact and function properly." This is the definition of integration testing. Integration testing focuses on verifying the communication and data flow between different modules, services, or layers (e.g., the web, application, and database tiers in a three-tier architecture) after they have been integrated. It is conducted after unit testing and before system-wide validation to detect faults in the interfaces and interactions between integrated components, which directly addresses the management's requirement.

Why Incorrect

A. Static code analysis: This is a pre-deployment activity that analyzes source code for security vulnerabilities and coding errors without executing the application. It does not test runtime component interaction.

B. Dynamic code analysis: This is a security-focused test performed on a running application to find vulnerabilities. It does not primarily verify the functional correctness of component interactions.

D. Package scanning: Also known as Software Composition Analysis (SCA), this process scans for known vulnerabilities in third-party libraries and dependencies, not the functional interaction between the application's own components.

References

1. University Courseware:

Massachusetts Institute of Technology (MIT) OpenCourseWare. (2013). 6.170 Software Studio, Lecture 10: Testing. Section "Levels of testing." The lecture notes define integration testing as the phase where individual modules are combined and tested as a group to expose faults in their interaction.

Available at: https://ocw.mit.edu/courses/6-170-software-studio-spring-2013/resources/mit6170s13lec10/

2. Official Vendor Documentation:

Microsoft. (2023). Testing overview - Azure DevOps. In the "Test types" section, integration tests are described as verifying that different parts of an application work correctly together, often involving testing interactions with external resources like databases.

Reference: https://learn.microsoft.com/en-us/azure/devops/test/overview?view=azure-devops#test-types

3. Peer-reviewed Academic Publications:

Bertolino, A. (2007). Software Testing Research: Achievements, Challenges, Dreams. 2007 Future of Software Engineering, 85-103. In Section 3.1, "Test Levels," integration testing is defined as the activity of "testing the interfaces among the integrated components."

DOI: https://doi.org/10.1109/FOSE.2007.30

Question 3 of 30

Question breakdown

Tests: Choose appropriate testing types in a CI/CD pipeline
Difficulty: Easy

Key idea: Integration testing checks that separate components or tiers communicate and work correctly together.

How to reach the answer

The deciding clue is 'all of the components of the application can interact and function properly.'
In a three-tier application, those interactions are between the web, application and database tiers.
Testing the interfaces and data flow between combined components is the definition of integration testing.
The other options are security analysis techniques, not tests of functional interaction.

Each option

AIncorrect. Static analysis reviews source code without running it, so it cannot confirm runtime interaction between tiers.
BIncorrect. Dynamic analysis probes a running application for security weaknesses rather than validating that components work together.
CCorrect. Integration testing directly verifies that the tiers and components exchange data and function correctly as a combined system.
DIncorrect. Package scanning checks third-party dependencies for known vulnerabilities and does not test functional interaction.

Common trap: Dynamic analysis also runs against the deployed application after deployment, so it seems to fit, but its goal is finding vulnerabilities, not proving that components cooperate.

In practice: Pipelines often run integration test suites against a staging environment after deployment. These confirm that API calls, database connections and service-to-service flows work before production promotion.

Remember: When the requirement is that components interact and function properly, think integration testing.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free CYBERSECURITY-ARCHITECTURE-AND-ENGINEERING practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test