CompTIA CASP+ Practice Test

As part of the SDL, what security activity should be prioritized during the testing phase of a newly developed application?

1. Grey box penetration testing.

2. Static code review.

3. Dynamic analysis.

4. Threat modeling.

The correct answer is: Grey box penetration testing.

Focusing on grey box penetration testing as a prioritized security activity during the testing phase of a newly developed application is particularly effective because it combines the benefits of both the internal knowledge of the application and the perspective of an external threat actor. In the testing phase, the application is typically in a more or less complete state, making it a critical time to evaluate its security posture. Grey box penetration testing allows testers to have partial access to the internal workings (like source code or architecture documentation) while still simulating an external attacker's approach, which reveals how the application might perform against malicious attempts. This method can uncover vulnerabilities that may not be evident through static reviews or solely external testing efforts. By utilizing this approach, teams can identify and rectify design flaws, logic errors, and security gaps before the application goes live, thus significantly enhancing overall security. Other activities such as static code review and dynamic analysis are also crucial but often occur in earlier phases or as part of ongoing processes. Grey box testing prioritizes actionable, real-world insights that can directly influence the effectiveness of the application’s security before its release.