Confirming threats have been mitigated

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. After a control is applied to fix a vulnerability, what should the team do next?

A Assume the threat is gone because the control was installed

B Retest the control to prove the threat is actually reduced

2. Which statement about residual risk is correct?

A Some risk can remain after a control is applied, so it must be assessed and recorded

B Once a control is applied, the risk is always reduced to zero

3. A developer adds input validation to stop SQL injection. Which action best confirms the threat is mitigated?

A Run security tests that try SQL injection inputs and check they are rejected

B Check that the login form still looks the same on screen

4. Why should a peer review the code that contains a new security control?

A To check the control is correct and has not created a new weakness

B To avoid having to run any security tests at all

5. Which is the best evidence that a threat has been mitigated?

A A developer's verbal comment that it should be fine now

B A recorded test result showing the earlier attack now fails

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Verification testing		ARetesting a control after it is applied to prove the threat is actually reduced and no new weakness was created
2Residual risk		Blog: 2025-03-12 \| SQLi retest \| PASS \| screenshot_14.png
3After adding input validation, the team re-runs the same SQL injection attack that worked before to see if it now fails		CThe risk that remains after a control has been applied and tested
4The tester records the test date, result and evidence so the organisation can prove the control works		Drun_test("' OR 1=1 --") -> expect: rejected
5control_applied = True threat_reduced = True # assumed, not tested		EThe new code was not reviewed, so a new weakness may have been introduced, and residual risk was ignored instead of being recorded.
6retest: PASS residual_risk = None new_code_reviewed = False		FThe team assumes the threat is reduced without retesting the control, so there is no proof it works.

Definitions

Verification testing

Fill in the Blanks

Complete each line of code by filling in the missing parts.

assert attackWorked == _____

residual = before _ removed

evidence = [] evidence.______("retest passed")

if len(newIssues) _ 0: print("New weakness found")

if reviewed ___ testsPassed: status = "verified"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A payload = "' OR '1'='1"

B result = login("admin", payload)

C if result == "granted":

D print("Control works")

Question 2

A def retest(control, attack)

B result = attack(control)

C return result == "blocked"

Question 3

A evidence = []

B test = run_test("XSS check")

C evidence.append(test)

D print(length(evidence))

Question 4

A risk_before = 9

B risk_after == 3

C residual = risk_after

D print(residual)

Question 5

A tests = ["login", "upload"

B for t in tests:

C print("Retesting", t)

Answer Key

Confirming threats have been mitigated

Section A: Quick Questions

B — Retest the control to prove the threat is actually reduced

A — Some risk can remain after a control is applied, so it must be assessed and recorded

A — Run security tests that try SQL injection inputs and check they are rejected

A — To check the control is correct and has not created a new weakness

B — A recorded test result showing the earlier attack now fails

Section B: Match the Pairs

Verification testing → Retesting a control after it is applied to prove the threat is actually reduced and no new weakness was created

Residual risk → The risk that remains after a control has been applied and tested

After adding input validation, the team re-runs the same SQL injection attack that worked before to see if it now fails → run_test("' OR 1=1 --") -> expect: rejected

The tester records the test date, result and evidence so the organisation can prove the control works → log: 2025-03-12 | SQLi retest | PASS | screenshot_14.png

control_applied = True threat_reduced = True # assumed, not tested → The team assumes the threat is reduced without retesting the control, so there is no proof it works.

retest: PASS residual_risk = None new_code_reviewed = False → The new code was not reviewed, so a new weakness may have been introduced, and residual risk was ignored instead of being recorded.

Section C: Definitions

Verification testing — Retesting a control after it is applied, using code review and security tests, to prove the threat is reduced, check no new weakness exists, note residual risk and record the evidence.

Section D: Fill in the Blanks

assert attackWorked == False

residual = before - removed

evidence = []
evidence.append("retest passed")

if len(newIssues) > 0:
    print("New weakness found")

if reviewed and testsPassed:
    status = "verified"

Section E: Spot the Error

C — The retest sends an SQL injection payload. The control works only if the login is denied. Checking for "granted" would report success when the attack got through. It should be if result == "denied":.

A — A Python function definition must end with a colon. It should be def retest(control, attack):.

D — Python has no length() function. The built-in that counts the recorded evidence items is len(). It should be print(len(evidence)).

B — A single = assigns a value. == compares values, so risk_after would never be created. The line should be risk_after = 3 so the residual risk can be recorded.

A — The list is missing its closing square bracket. It should be tests = ["login", "upload"].