Selenium Testing Framework Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A Selenium test must verify GDPR cookie consent compliance. Which sequence of assertions is correct?
- On first visit, assert consent banner is visible and no analytics cookies are set; after accepting, assert analytics cookies are present (Correct answer)
- Assert all cookies are set on page load, then check banner visibility
- Verify that the banner disappears after 5 seconds automatically
- Check that the banner text is at least 200 characters
Correct answer: On first visit, assert consent banner is visible and no analytics cookies are set; after accepting, assert analytics cookies are present
GDPR requires no non-essential cookies before explicit consent, so the banner must appear first and analytics cookies must only be set after user acceptance.
Question 2: Which Selenium approach validates compliance with WCAG 2.1 Success Criterion 2.4.3 (Focus Order)?
- Tab through all interactive elements and assert that focus moves in a logical, content-order sequence (Correct answer)
- Click every button and assert it performs its action
- Verify no element has tabindex='-1'
- Assert all links open in the same tab
Correct answer: Tab through all interactive elements and assert that focus moves in a logical, content-order sequence
WCAG 2.4.3 requires focus to follow a sequence that preserves meaning, which is validated by tabbing through the page and verifying the order matches the visual/logical layout.
Question 3: Under OWASP Top 10 compliance testing, which Selenium technique helps identify Broken Access Control (A01)?
- Log in as a low-privilege user and attempt to navigate directly to admin-only URLs, asserting a 403 or redirect response (Correct answer)
- Check that all forms have CSRF tokens in the DOM
- Verify password fields have type='password'
- Assert that session cookies have the HttpOnly flag
Correct answer: Log in as a low-privilege user and attempt to navigate directly to admin-only URLs, asserting a 403 or redirect response
Broken Access Control is detected by testing whether unauthorized users can access restricted resources directly, which Selenium can automate by navigating to protected URLs with underprivileged sessions.
Question 4: When automating compliance tests for a multilingual US government site under Executive Order 13166 (language access), what should Selenium verify?
- That language selection controls are present, functional, and persist the user's chosen language across pages (Correct answer)
- That the site loads in English by default for all users
- That translation is provided only for the homepage
- That font size is large enough for non-native readers
Correct answer: That language selection controls are present, functional, and persist the user's chosen language across pages
EO 13166 requires meaningful access for people with limited English proficiency, so language selection must be discoverable, functional, and persistent.
Question 5: A Selenium test suite must comply with data minimization principles under GDPR Article 5. Which test design practice aligns with this?
- Use synthetic or anonymized test data instead of real user PII in test scripts and fixtures (Correct answer)
- Use production database snapshots for realistic test coverage
- Store user emails and passwords in test configuration files
- Log full HTTP request/response bodies including personal data
Correct answer: Use synthetic or anonymized test data instead of real user PII in test scripts and fixtures
GDPR data minimization requires collecting only necessary data; test suites should mirror this by using synthetic data rather than real PII.
Question 6: Which Selenium assertion best validates WCAG 2.1 SC 1.4.3 (Contrast Minimum) compliance?
- Extract computed CSS color and background-color values via JavaScript and calculate the contrast ratio programmatically (Correct answer)
- Check that text color is not white on white backgrounds
- Verify that font-size is at least 16px for all body text
- Assert that CSS stylesheets are loaded without errors
Correct answer: Extract computed CSS color and background-color values via JavaScript and calculate the contrast ratio programmatically
Contrast ratio validation requires extracting actual rendered colors via JavaScript execution and calculating the WCAG-defined luminance ratio, which must be at least 4.5:1.
Question 7: Under the California Consumer Privacy Act (CCPA), which Selenium test verifies the 'Do Not Sell My Personal Information' requirement?
- Navigate to the homepage and assert a 'Do Not Sell' link is present in the footer, then verify it leads to a functional opt-out form (Correct answer)
- Check that the privacy policy page loads without errors
- Verify that all form fields have privacy tooltips
- Assert that user accounts are deleted within 45 days
Correct answer: Navigate to the homepage and assert a 'Do Not Sell' link is present in the footer, then verify it leads to a functional opt-out form
CCPA mandates a conspicuous 'Do Not Sell My Personal Information' link that leads to an actionable opt-out mechanism.
Selenium Testing Framework Regulatory Frameworks & Compliance 4
A Selenium test must verify GDPR cookie consent compliance.
Which sequence of assertions is correct?