The city's 311 mobile app exposes a citizen UI, backend APIs, and network entry points. How should security testing be scoped across those surfaces?
Select an answer to reveal the explanation.
Short Explanation
A 311 app is three doors—screen, wires, and API. Each can fail differently, so test all three. Pretty splash art, ‘network will save us,’ or admin-only scope leaves citizen-facing cracks unchecked.
Full Explanation
Interface testing in CISSP assessment practice covers UI, network, and API boundaries because each presents unique attack paths and control failures. Graphics-only checks, assumptions that network defenses obsolete API testing, or excluding the public UI leave material exposure. Municipal 311 services require breadth across those interfaces before claiming adequate control testing.