CASE Quality Assurance & Compliance 5

Question 1

What is the main advantage of using threat modeling as part of QA rather than as a standalone security activity?

Accepted Answer

It aligns security test cases with identified threats before code is written

Answer

Integrating threat modeling into QA allows test engineers to derive targeted test cases from identified threats early, increasing test relevance and coverage.

Question 2

When evaluating third-party software for inclusion in a product, which document most directly supports supply chain security compliance?

Accepted Answer

Software Composition Analysis (SCA) report

Answer

An SCA report enumerates all open-source and third-party components, their licenses, and known CVEs, directly supporting supply chain risk assessment.

Question 3

Which OWASP ASVS level requires verification of security controls against a defined threat model and is targeted at high-value applications?

Accepted Answer

Level 3

Answer

OWASP ASVS Level 3 is the highest level, intended for critical applications requiring the most rigorous security verification including threat model alignment.

Question 4

An application undergoes a SOC 2 Type II audit. What distinguishes a Type II audit from a Type I audit?

Accepted Answer

Type II evaluates the operating effectiveness of controls over a period of time, not just design

Answer

SOC 2 Type II assesses whether controls were operating effectively over a defined period (typically 6–12 months), whereas Type I only evaluates whether controls are suitably designed at a point in time.

Question 5

A QA team discovers that input validation is implemented only on the client side in a web application. Why is this a compliance and security concern?

Accepted Answer

Attackers can bypass client-side validation and send malicious data directly to the server

Answer

Client-side validation can be trivially bypassed using browser developer tools or by sending raw HTTP requests, so all validation must also be enforced server-side.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Quality Assurance & Compliance 5