CASE Quality Assurance & Compliance 3 — Questions and Answers
Question 1: Which standard provides a framework specifically for information security management systems (ISMS) and is commonly referenced in compliance audits?
- ISO/IEC 27001 (Correct answer)
- NIST SP 800-53
- CIS Controls v8
- COBIT 2019
Correct answer: ISO/IEC 27001
ISO/IEC 27001 is the international standard specifying requirements for establishing, implementing, maintaining, and continually improving an ISMS.
Question 2: During a compliance audit, an auditor asks for evidence that security patches are applied within a defined SLA. Which QA artifact best satisfies this request?
- Penetration test report
- Patch management log with timestamps (Correct answer)
- Vulnerability scanner configuration file
- Security policy document
Correct answer: Patch management log with timestamps
A patch management log with timestamps provides direct evidence of when patches were received, approved, and applied relative to the SLA requirement.
Question 3: What is the primary purpose of a software bill of materials (SBOM) in a security compliance context?
- To document code review findings
- To identify all third-party components and their known vulnerabilities (Correct answer)
- To track developer security training completion
- To record penetration testing scope
Correct answer: To identify all third-party components and their known vulnerabilities
An SBOM provides a complete inventory of software components, enabling organizations to quickly identify exposure when new CVEs affect third-party dependencies.
Question 4: A QA team is performing security testing on an API and wants to verify that rate limiting controls meet compliance requirements. Which test type is most appropriate?
- Static application security testing (SAST)
- Functional security testing (Correct answer)
- Fuzz testing
- Dependency scanning
Correct answer: Functional security testing
Functional security testing verifies that implemented security controls such as rate limiting behave as specified under defined conditions.
Question 5: Which FedRAMP authorization type allows a cloud service provider to reuse an existing authorization package for a new government agency customer?
- Initial Authorization
- Joint Authorization Board (JAB) Provisional Authorization
- Agency Authorization to Operate (ATO)
- Reuse through FedRAMP Marketplace (Correct answer)
Correct answer: Reuse through FedRAMP Marketplace
FedRAMP's reuse model allows agencies to leverage an existing authorized package on the FedRAMP Marketplace, reducing duplicative assessment effort.
Question 6: In secure SDLC, what is the purpose of performing a security architecture review before development begins?
- To generate penetration testing scope documents
- To identify design-level flaws that are cheaper to fix early (Correct answer)
- To satisfy post-deployment audit requirements
- To assign CVE identifiers to known risks
Correct answer: To identify design-level flaws that are cheaper to fix early
Security architecture reviews catch design flaws at the phase where remediation cost is lowest, following the well-known principle that defects cost exponentially more to fix later.
Question 7: Which of the following best describes the role of a quality gate in a CI/CD pipeline for security compliance?
- A manual approval step performed by an external auditor
- An automated check that blocks promotion of builds that fail defined security thresholds (Correct answer)
- A scheduled weekly scan of the production environment
- A process for logging developer access to source repositories
Correct answer: An automated check that blocks promotion of builds that fail defined security thresholds
Quality gates enforce compliance by automatically preventing builds with unacceptable security findings from progressing to the next environment.
CASE Quality Assurance & Compliance 3
Which standard provides a framework specifically for information security management systems (ISMS) and is commonly referenced in compliance audits?