Testers validating the park-and-recreation permit site only exercise successful purchase paths. What should they add to strengthen security testing?
Select an answer to reveal the explanation.
Short Explanation
Happy paths show the front door works; misuse cases try the windows. Stack coupons, poke other people's permit IDs—that's how you catch abuse. Scrapbook shots, auth-blind load tests, and button surveys don't replace that.
Full Explanation
Misuse-case (abuse-case) testing deliberately exercises hostile or unexpected behaviors such as coupon stacking and insecure direct object references. Happy-path coverage alone underestimates authorization and business-logic risk. Cosmetic documentation, pure performance tests without authz checks, and usability surveys do not address those adversarial scenarios required in thorough security assessment.