CPMS Medical Software Development & Integration 5 — Questions and Answers
Question 1: What does the term 'regression testing' specifically address in iterative medical software development?
- Testing software on older hardware
- Verifying that new changes have not broken previously working functionality (Correct answer)
- Running tests in a production environment
- Evaluating software performance under stress
Correct answer: Verifying that new changes have not broken previously working functionality
Regression testing ensures that changes, bug fixes, or new features have not introduced defects into previously verified functionality.
Question 2: In FHIR, what is a 'Capability Statement' used for?
- Documenting a patient's functional abilities
- Describing the capabilities of a FHIR server, including supported resources and interactions (Correct answer)
- Asserting regulatory compliance claims
- Defining user roles and permissions
Correct answer: Describing the capabilities of a FHIR server, including supported resources and interactions
A FHIR CapabilityStatement resource declares what resources, operations, and search parameters a server supports, enabling interoperability discovery.
Question 3: Which security threat model is most relevant when designing a medical device API that accepts data from external partners?
- STRIDE (Correct answer)
- COBIT
- ITIL
- Six Sigma
Correct answer: STRIDE
STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege) is the standard threat modeling framework used for identifying security risks in software systems.
Question 4: When documenting software architecture for a Class C medical device under IEC 62304, which artifact is explicitly required?
- Marketing brochure
- Software architecture specification identifying software items and their interfaces (Correct answer)
- Source code comments only
- User manual draft
Correct answer: Software architecture specification identifying software items and their interfaces
IEC 62304 requires a documented software architecture that identifies all software items and their interfaces for Class B and C devices.
Question 5: Which approach best supports continuous compliance in an agile medical software development team?
- Deferring all documentation to end-of-sprint
- Embedding risk management and documentation tasks into each sprint's definition of done (Correct answer)
- Relying on a single compliance review at the end of the project
- Having a separate compliance team work independently from developers
Correct answer: Embedding risk management and documentation tasks into each sprint's definition of done
Embedding compliance activities (risk updates, traceability, documentation) into the sprint definition of done ensures ongoing regulatory readiness without a last-minute scramble.
Question 6: In a DICOM WADO (Web Access to DICOM Objects) service, what is the primary function?
- Schedule imaging procedures via a worklist
- Retrieve DICOM objects using web-based HTTP requests (Correct answer)
- Transmit billing data to hospital systems
- Perform image reconstruction on raw scanner data
Correct answer: Retrieve DICOM objects using web-based HTTP requests
WADO (Web Access to DICOM Objects) enables retrieval of DICOM instances via standard HTTP/HTTPS requests, making images accessible to web-based viewers.
Question 7: What is the significance of a 'change control process' in post-market medical software maintenance per IEC 62304?
- It controls marketing messaging about software updates
- It ensures that modifications are evaluated for impact on safety, risk, and regulatory status before implementation (Correct answer)
- It speeds up software releases by removing approval steps
- It is only required for Class A devices
Correct answer: It ensures that modifications are evaluated for impact on safety, risk, and regulatory status before implementation
Change control requires that every modification be assessed for its effect on safety classification, risk profile, and regulatory documentation before the change is made.
CPMS Medical Software Development & Integration 5
What does the term 'regression testing' specifically address in iterative medical software development?