jperezduerto.info
Security in depth · Unit 30 · Lesson 10 of 11
A retest answers a specific follow-up
Does a successful retest replace a full assessment?
Helpful before thisReporting: turn evidence into useful improvements
After this lesson you can
- Choose a qualified retest status from observations and explain what remains unverified.
One idea. Four observation packets. One qualified conclusion.
Match the status to the evidence
A fictional finding concerns a permission rule in web and mobile booking views. Staff should be unable to edit closed bookings; authorized supervisors should retain that ability. A focused follow-up examines this condition on version 2.1. The packets below are alternative supplied outcomes, not instructions to perform checks.
A: Fixed within scope. Comparable observations cover both views: staff edits are denied and approved supervisor edits succeed. Model wording: “Correction verified for the stated version, roles, and closed-booking cases.” Other features remain outside scope.
B: Partially fixed. The web view now enforces the intended rule; the mobile view still permits the prohibited staff action. Model wording: “Web correction verified; mobile condition remains open.” One successful component cannot close the whole finding.
C: Not reproduced. A follow-up was performed using changed booking data after the original records were retired. The reported behavior was not observed, but comparable conditions and the intended correction were not verified. Model wording: “Not observed under changed conditions; correction unverified.” Missing comparison evidence is not evidence of a fix.
D: Not retested. Follow-up work was deferred and no current observations were collected. Model wording: “No retest result; prior finding remains unresolved pending review.” A developer’s completion note alone would not change this status.
Keep the boundary visible
These are the reporting labels agreed for this exercise; organizations may use different taxonomies. Record date, version, covered cases, observations, and limitations. Even packet A answers a specific follow-up question rather than establishing that the entire application is secure.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Packet C includes a performed follow-up, but changed booking data prevents a comparable check and the correction remains unverified. Which status is supported?
Show the answer
Correct answer: Not reproduced under changed conditions; correction unverified. The behavior was not observed, but missing comparable evidence prevents a verified-fix conclusion.
Try it
- WriteWrite four status lines for packets A-D, each naming status, supporting observation, and limitation. For C, add the missing comparison evidence needed before claiming correction. Use only the fictional observations.