For Teachers · Back to the Module · Print with your browser's Print command.

P23 Worksheet: Test Design for Security Checks

Student Worksheet (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Use equivalence partitioning and boundary values to pick test cases.
• [ ] Explain why every check needs a failing and a passing example.
• [ ] Recognise false positives and false negatives as test design problems.

Key Terms

Write each definition in your own words.

• Equivalence Partitioning: ______________________________________________
• Boundary Value: ______________________________________________
• False Positive: ______________________________________________
• False Negative: ______________________________________________
• Test Fixture: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt explain HOST-SSH-001 and list the input groups its detection must handle.
2. Run: openvapt demo vulnerable --only HOST-SSH-001 --out p23v and openvapt demo hardened --only HOST-SSH-001 --out p23h, then compare the evidence.

Self-Check Questions

1. What is equivalence partitioning?

• [ ] a) Testing every possible input
• [ ] b) Grouping inputs the system should treat the same and testing one from each group
• [ ] c) Splitting a disk into partitions
• [ ] d) Running tests in parallel

1. A check fails when a value is above 4. Which pair of cases tests the boundary best?

• [ ] a) 1 and 100
• [ ] b) 4 and 5
• [ ] c) 0 and 10
• [ ] d) Only 10

1. What does the vulnerable lab catch?

• [ ] a) False positives
• [ ] b) False negatives: checks that miss a real weakness
• [ ] c) Slow checks
• [ ] d) Spelling mistakes

1. What does the hardened lab catch?

• [ ] a) False positives: checks that flag a correct setting
• [ ] b) Missing documentation
• [ ] c) Network outages
• [ ] d) Expired certificates only

1. A check gives a wrong result on a real server. What comes first?

• [ ] a) Delete the check
• [ ] b) Add a lab case that reproduces the problem
• [ ] c) Lower its severity
• [ ] d) Ignore it

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.