Testing that a security control works

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A student tests a login control. Which test is a realistic case?

A Read the login page and assume it works

B Enter a wrong password and check that access is refused

2. A permission is set so Year 9 students can only read a marks file. How do you test it?

A Log in as a Year 9 student and try to edit the file

B Log in as the teacher and open the file

3. Which is the best way to test a backup?

A Check that the backup file exists on the drive

B Restore the backup and check the files open and are complete

4. After a control test, what should you record?

A The test case, the expected result and the actual result

B Only the word 'done'

5. A restricted user could delete a file during a permission test. What does this show?

A The control failed and needs fixing

B The control passed because the test ran

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Test: log in with a wrong password. Expected: access denied. Actual: access denied. Result: Pass		AThe backup was never restored, so nobody knows whether the data can be recovered.
2Restore test: restore backup to a spare folder, then open files. Result: Fail, 3 files corrupt		Buser = read_only; action = edit file; expected = denied; actual = denied; result = Pass
3Testing a permission: sign in as a read-only user and try to change a file, then check that the change is blocked		CTesting with a correct password does not test the control. It needs a realistic failing case such as a wrong password.
4Recording the result of a control test so the evidence can be reviewed later		DA backup restore test that found a fault, because the restored files did not work as expected.
5Test: log in with the correct password. Result: Pass, so the lockout control works.		EA recorded control test: a realistic case was tried, the expected and actual outcomes were compared, and the result was logged.
6Backup control: backup job ran last night, so it works. Result: Pass (no restore tried)		FDate: 12 May \| Control: MFA \| Expected: code required \| Actual: code required \| Result: Pass

Definitions

control test

Fill in the Blanks

Complete each line of code by filling in the missing parts.

__ login(wrongPassword) = "denied" THEN result ← "Pass" ENDIF

attempt ← write("restricted", "payroll") expected ← "denied" IF attempt = ________ THEN result ← "Pass"

copy ← _______(backupFile) IF rows(copy) = rows(original) THEN result ← "Pass"

IF actual = expected THEN result ← "Pass" ____ result ← "Fail" OUTPUT testId, result

testId ← "T3" result ← "Pass" ______ testId, result

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A case <- correct password

B expected <- Access denied

C actual <- Access denied

D IF actual = expected THEN

E result <- PASS

Question 2

A user <- restricted user

B expected <- Access granted

C action <- delete payroll file

D actual <- Access denied

Question 3

A backup <- latest backup

B restore backup to live server

C count restored files

D result <- PASS

Question 4

A user <- admin account

B action <- open admin page

C expected <- Access denied

D actual <- Access denied

Question 5

A expected <- Access denied

B actual <- Access granted

C result <- PASS

D log the result and date

Answer Key

Testing that a security control works

Section A: Quick Questions

B — Enter a wrong password and check that access is refused

A — Log in as a Year 9 student and try to edit the file

B — Restore the backup and check the files open and are complete

A — The test case, the expected result and the actual result

A — The control failed and needs fixing

Section B: Match the Pairs

Test: log in with a wrong password. Expected: access denied. Actual: access denied. Result: Pass → A recorded control test: a realistic case was tried, the expected and actual outcomes were compared, and the result was logged.

Restore test: restore backup to a spare folder, then open files. Result: Fail, 3 files corrupt → A backup restore test that found a fault, because the restored files did not work as expected.

Testing a permission: sign in as a read-only user and try to change a file, then check that the change is blocked → user = read_only; action = edit file; expected = denied; actual = denied; result = Pass

Recording the result of a control test so the evidence can be reviewed later → Date: 12 May | Control: MFA | Expected: code required | Actual: code required | Result: Pass

Test: log in with the correct password. Result: Pass, so the lockout control works. → Testing with a correct password does not test the control. It needs a realistic failing case such as a wrong password.

Backup control: backup job ran last night, so it works. Result: Pass (no restore tried) → The backup was never restored, so nobody knows whether the data can be recovered.

Section C: Definitions

control test — Try a security control with a realistic case, like a wrong password or restricted user, then record whether it behaved as expected.

Section D: Fill in the Blanks

IF login(wrongPassword) = "denied" THEN
  result ← "Pass"
ENDIF

attempt ← write("restricted", "payroll")
expected ← "denied"
IF attempt = expected THEN result ← "Pass"

copy ← restore(backupFile)
IF rows(copy) = rows(original) THEN
  result ← "Pass"

IF actual = expected THEN result ← "Pass"
ELSE result ← "Fail"
OUTPUT testId, result

testId ← "T3"
result ← "Pass"
OUTPUT testId, result

Section E: Spot the Error

A — A login control is tested with a wrong password, because the expected result is 'Access denied'. A correct password would be allowed in, so it should be: case <- wrong password.

B — A restricted user should not be able to delete the payroll file, so the expected result is 'Access denied'. It should be: expected <- Access denied.

B — A restore test should be done on a separate test server so live data is not overwritten if something goes wrong. It should be: restore backup to test server.

A — To test that the permission blocks unauthorised users, the test must use a guest account. An admin is meant to have access, so it should be: user <- guest account.

C — The actual result (Access granted) did not match the expected result (Access denied), so the control failed the test. It should be: result <- FAIL.