When testing, there is no check that tests to see if the CSC is 3 or 4 digits when entered. It is simply passed over to the simulator. So for example the value of "9" that you enter is recognized as "009". However, once you go live the value of 9 for example would come back as a failure since it actually passes this over to the processor and card issuing bank.
If you are wanting to trigger a CSC failure, you can enter "999" for the value. The values that you can enter to trigger specific CSC matches are listed in the developers guide.