CAST Professional Ethics & Standards 2 — Questions and Answers
Question 1: A tester discovers a critical security vulnerability but is told by management to delay reporting it to meet the release deadline. What is the ethically correct action?
- Comply with management and delay the report
- Immediately escalate the issue through appropriate channels regardless of the deadline (Correct answer)
- Anonymously leak the vulnerability to the press
- Ignore the vulnerability and proceed with testing other areas
Correct answer: Immediately escalate the issue through appropriate channels regardless of the deadline
Professional ethics require testers to report critical issues promptly through proper channels, as delaying a security vulnerability report puts users at risk.
Question 2: Which IEEE standard is most closely associated with software testing processes and documentation?
- IEEE 829 (Correct answer)
- IEEE 802.11
- IEEE 1003
- IEEE 754
Correct answer: IEEE 829
IEEE 829 is the standard for Software and System Test Documentation, covering test plans, test cases, and test reports.
Question 3: A tester is offered a gift by a vendor whose software is under evaluation. What is the most ethical response?
- Accept the gift if it is below a certain monetary threshold
- Decline the gift to avoid any conflict of interest (Correct answer)
- Accept the gift but disclose it to management
- Accept the gift since it does not affect the testing results
Correct answer: Decline the gift to avoid any conflict of interest
Accepting gifts from vendors under evaluation creates a conflict of interest, and the most ethical action is to decline to maintain objectivity.
Question 4: According to the CAST code of ethics, what is a tester's primary professional responsibility?
- Ensuring the product ships on time
- Serving the public interest and maintaining integrity in testing activities (Correct answer)
- Maximizing the number of defects found per hour
- Following all instructions given by management without question
Correct answer: Serving the public interest and maintaining integrity in testing activities
The primary professional responsibility of a software tester, per ethical codes, is to serve the public interest and maintain integrity in all testing activities.
Question 5: A colleague asks you to sign off on a test report for tests you did not perform. What should you do?
- Sign it since your colleague performed the tests correctly
- Refuse to sign and explain that you can only attest to work you personally performed or verified (Correct answer)
- Sign it to support your colleague and maintain team harmony
- Delegate the signing to someone else without explanation
Correct answer: Refuse to sign and explain that you can only attest to work you personally performed or verified
Professional integrity requires that testers only attest to work they have personally performed or directly verified, and signing falsely constitutes professional misconduct.
Question 6: In the context of software testing ethics, what does 'due care' mean?
- Completing tests as quickly as possible
- Applying the level of competence and diligence that a reasonable professional would exercise (Correct answer)
- Only running tests specified in the test plan
- Deferring all critical decisions to senior management
Correct answer: Applying the level of competence and diligence that a reasonable professional would exercise
Due care means exercising the competence and diligence that a reasonable and prudent professional would apply in the same circumstances.
Question 7: A tester finds a defect that could harm end users but is told the fix is too expensive for this release. What is the most ethical course of action?
- Accept management's decision and close the defect
- Ensure the defect is properly documented, escalated, and the risk is formally accepted by authorized stakeholders (Correct answer)
- Refuse to proceed with any further testing until the defect is fixed
- Immediately notify end users directly about the defect
Correct answer: Ensure the defect is properly documented, escalated, and the risk is formally accepted by authorized stakeholders
The ethical approach is to document the defect thoroughly, escalate it appropriately, and ensure the risk is formally accepted by those with authority to make that decision.
CAST Professional Ethics & Standards 2
A tester discovers a critical security vulnerability but is told by management to delay reporting it to meet the release deadline.
What is the ethically correct action?