CASE Quality Assurance & Compliance 2

Question 1

Which metric is most useful for tracking the effectiveness of a security testing program over multiple release cycles?

Accepted Answer

Defect escape rate for security vulnerabilities

Answer

Defect escape rate measures how many security vulnerabilities pass through QA and reach production, directly reflecting program effectiveness.

Question 2

In the context of PCI DSS compliance, what is the minimum frequency for running internal vulnerability scans?

Accepted Answer

Quarterly

Answer

PCI DSS Requirement 11.3.1 mandates that internal vulnerability scans be performed at least quarterly.

Question 3

A QA engineer discovers that a security control implemented to meet SOC 2 requirements is technically present but ineffective. Which audit concept does this represent?

Accepted Answer

Control deficiency

Answer

A control deficiency exists when a control is designed or operating in a way that does not allow management to prevent or detect misstatements on a timely basis.

Question 4

Which OWASP resource is specifically designed to help organizations integrate security into their software development quality processes?

Accepted Answer

OWASP SAMM

Answer

OWASP SAMM (Software Assurance Maturity Model) provides a framework for integrating security into the software development and quality assurance lifecycle.

Question 5

When implementing a security regression test suite, which approach best prevents previously fixed vulnerabilities from reappearing?

Accepted Answer

Adding automated test cases derived from each resolved security bug

Answer

Creating automated test cases from resolved security bugs ensures those specific vulnerabilities are continuously verified in subsequent builds.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Quality Assurance & Compliance 2