How should you design security test cases?

• A. Only unit test of functions.
• B. Boundary and edge cases, invalid inputs, authorization checks, session management tests, input validation scenarios, and expected versus actual outcomes.
• C. Random guesses.
• D. Only performance tests.

Answer: (B)

Designing security test cases means systematically exercising how the system handles inputs and controls access under realistic conditions. Include boundary and edge cases to reveal issues that show up at limits, as well as invalid inputs to verify proper validation and error handling. Check authorization to ensure only permitted users can access resources, and test session management to guard against hijacking, fixation, and improper termination. Include input validation scenarios to prevent injections and other attacks, and compare expected versus actual outcomes to confirm that security controls behave correctly and fail safely. This broad, methodical coverage targets how the system defends itself across input handling, authentication, and authorization, which is essential for effective security testing. Focusing only on unit tests, random guessing, or performance tests misses these critical security dimensions.