CASE Quality Assurance & Compliance 2 — Questions and Answers
Question 1: Which metric is most useful for tracking the effectiveness of a security testing program over multiple release cycles?
- Mean time between failures (MTBF)
- Defect escape rate for security vulnerabilities (Correct answer)
- Total lines of code analyzed per sprint
- Number of penetration tests performed per year
Correct answer: Defect escape rate for security vulnerabilities
Defect escape rate measures how many security vulnerabilities pass through QA and reach production, directly reflecting program effectiveness.
Question 2: In the context of PCI DSS compliance, what is the minimum frequency for running internal vulnerability scans?
- Monthly
- Quarterly (Correct answer)
- Semi-annually
- Annually
Correct answer: Quarterly
PCI DSS Requirement 11.3.1 mandates that internal vulnerability scans be performed at least quarterly.
Question 3: A QA engineer discovers that a security control implemented to meet SOC 2 requirements is technically present but ineffective. Which audit concept does this represent?
- Control deficiency (Correct answer)
- Material weakness
- Compensating control failure
- Design exception
Correct answer: Control deficiency
A control deficiency exists when a control is designed or operating in a way that does not allow management to prevent or detect misstatements on a timely basis.
Question 4: Which OWASP resource is specifically designed to help organizations integrate security into their software development quality processes?
- OWASP Top Ten
- OWASP SAMM (Correct answer)
- OWASP ASVS
- OWASP WSTG
Correct answer: OWASP SAMM
OWASP SAMM (Software Assurance Maturity Model) provides a framework for integrating security into the software development and quality assurance lifecycle.
Question 5: When implementing a security regression test suite, which approach best prevents previously fixed vulnerabilities from reappearing?
- Running the full penetration test suite on every commit
- Adding automated test cases derived from each resolved security bug (Correct answer)
- Requiring manual code review for all changes
- Updating the threat model after every sprint
Correct answer: Adding automated test cases derived from each resolved security bug
Creating automated test cases from resolved security bugs ensures those specific vulnerabilities are continuously verified in subsequent builds.
Question 6: Under HIPAA Security Rule compliance, which activity is a required implementation specification for technical safeguards?
- Workforce clearance procedure
- Audit controls (Correct answer)
- Business associate agreements
- Contingency plan testing
Correct answer: Audit controls
HIPAA Security Rule §164.312(b) requires covered entities to implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.
Question 7: A development team uses acceptance criteria that include security requirements. Which agile QA practice does this represent?
- Security spike
- Definition of done with security gates (Correct answer)
- Threat modeling ceremony
- Security-focused retrospective
Correct answer: Definition of done with security gates
Embedding security requirements into the definition of done ensures no user story is accepted without meeting specified security acceptance criteria.
CASE Quality Assurance & Compliance 2
Which metric is most useful for tracking the effectiveness of a security testing program over multiple release cycles?