CAD Quality Assurance & Compliance 3 — Questions and Answers
Question 1: Which ServiceNow feature allows developers to capture a set of configuration changes and migrate them between instances while maintaining traceability?
- Clone utility
- Update Sets (Correct answer)
- Table Rotation
- Scheduled Import
Correct answer: Update Sets
Update Sets record configuration changes made on one instance and allow those changes to be exported and imported into another instance.
Question 2: What does the term 'shift-left testing' mean in a software quality context?
- Moving testing activities earlier in the development lifecycle (Correct answer)
- Assigning testing to left-side team members
- Running tests from left to right in a pipeline
- Shifting test environments to the left data center
Correct answer: Moving testing activities earlier in the development lifecycle
Shift-left testing advocates catching defects earlier by integrating testing activities into design and development phases rather than waiting until the end.
Question 3: In compliance-driven development, what is the purpose of an audit trail?
- To speed up deployments
- To provide a chronological record of system activities for accountability and investigation (Correct answer)
- To reduce database storage
- To generate user interface mockups
Correct answer: To provide a chronological record of system activities for accountability and investigation
Audit trails log who did what and when, enabling traceability, compliance verification, and forensic investigation.
Question 4: A developer notices that their ServiceNow script includes a hard-coded administrator password. Which compliance concern does this violate?
- Performance benchmarking
- Credential management and secure coding standards (Correct answer)
- UI accessibility guidelines
- API rate limiting policy
Correct answer: Credential management and secure coding standards
Hard-coding credentials violates secure coding standards and credential management policies, exposing sensitive data in version-controlled code.
Question 5: Which testing type validates that separately developed modules work correctly when combined?
- Unit testing
- Integration testing (Correct answer)
- Exploratory testing
- Stress testing
Correct answer: Integration testing
Integration testing verifies that multiple modules or services interact correctly when combined, catching interface mismatches and data-flow errors.
Question 6: What does OWASP primarily provide to help developers build more secure applications?
- Certified cloud infrastructure
- A list of the most critical web application security risks and mitigation guidance (Correct answer)
- Database optimization benchmarks
- Automated deployment pipelines
Correct answer: A list of the most critical web application security risks and mitigation guidance
OWASP (Open Web Application Security Project) publishes the OWASP Top 10 and other resources that guide developers in identifying and mitigating common security vulnerabilities.
Question 7: In a CI/CD pipeline, quality gates are used to:
- Grant production access to administrators
- Automatically block promotion of code that fails defined quality criteria (Correct answer)
- Archive old build artifacts
- Schedule maintenance windows
Correct answer: Automatically block promotion of code that fails defined quality criteria
Quality gates enforce thresholds (e.g., test coverage, zero critical bugs) that must be met before code advances to the next pipeline stage.
CAD Quality Assurance & Compliance 3
Which ServiceNow feature allows developers to capture a set of configuration changes and migrate them between instances while maintaining traceability?