CASE Quality Assurance & Compliance 3

Question 1

Which standard provides a framework specifically for information security management systems (ISMS) and is commonly referenced in compliance audits?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 is the international standard specifying requirements for establishing, implementing, maintaining, and continually improving an ISMS.

Question 2

During a compliance audit, an auditor asks for evidence that security patches are applied within a defined SLA. Which QA artifact best satisfies this request?

Accepted Answer

Patch management log with timestamps

Answer

A patch management log with timestamps provides direct evidence of when patches were received, approved, and applied relative to the SLA requirement.

Question 3

What is the primary purpose of a software bill of materials (SBOM) in a security compliance context?

Accepted Answer

To identify all third-party components and their known vulnerabilities

Answer

An SBOM provides a complete inventory of software components, enabling organizations to quickly identify exposure when new CVEs affect third-party dependencies.

Question 4

A QA team is performing security testing on an API and wants to verify that rate limiting controls meet compliance requirements. Which test type is most appropriate?

Accepted Answer

Functional security testing

Answer

Functional security testing verifies that implemented security controls such as rate limiting behave as specified under defined conditions.

Question 5

Which FedRAMP authorization type allows a cloud service provider to reuse an existing authorization package for a new government agency customer?

Accepted Answer

Reuse through FedRAMP Marketplace

Answer

FedRAMP's reuse model allows agencies to leverage an existing authorized package on the FedRAMP Marketplace, reducing duplicative assessment effort.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Quality Assurance & Compliance 3