Selenium Testing Framework Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A Selenium framework must support ITAR compliance for a defense contractor's web application. What is the most critical test data management rule?
- Test data must not include actual technical data controlled under ITAR, and test environments must be access-controlled to US persons only (Correct answer)
- Test data should be exported to offshore teams for cost-effective test execution
- Any employee can run tests as long as results stay internal
- Test reports can be stored in any cloud storage service
Correct answer: Test data must not include actual technical data controlled under ITAR, and test environments must be access-controlled to US persons only
ITAR restricts export of controlled defense-related technical data, so test data and environments must comply with the same export control restrictions.
Question 2: When validating WCAG 2.1 SC 4.1.2 (Name, Role, Value) with Selenium, which assertion is most appropriate for a custom dropdown widget?
- Assert the widget has role='combobox', a visible label, aria-expanded reflects its state, and aria-activedescendant points to the selected option (Correct answer)
- Verify the dropdown opens when clicked
- Check that the dropdown has a border style
- Assert the dropdown closes when clicking outside it
Correct answer: Assert the widget has role='combobox', a visible label, aria-expanded reflects its state, and aria-activedescendant points to the selected option
SC 4.1.2 requires custom controls to expose name, role, and value programmatically so assistive technologies can interpret them correctly.
Question 3: Which strategy ensures Selenium tests themselves comply with SOC 2 Type II security requirements for a SaaS company?
- Encrypt test result artifacts, restrict CI access by role, and retain logs for the audit period (typically 12 months) (Correct answer)
- Share CI credentials across all engineers for efficiency
- Store test results in a public S3 bucket for easy access
- Rotate test accounts annually without logging the rotation
Correct answer: Encrypt test result artifacts, restrict CI access by role, and retain logs for the audit period (typically 12 months)
SOC 2 Type II evaluates security controls over time; encrypted artifacts, role-based access, and retained logs provide the ongoing evidence auditors require.
Question 4: Under the EU AI Act, when Selenium is used to test an AI-driven hiring application classified as 'high-risk', which compliance test is mandatory?
- Verify that candidates are informed they are interacting with an AI system, with Selenium asserting the disclosure UI is present and dismissible (Correct answer)
- Check that the AI model response time is under 2 seconds
- Assert that model accuracy exceeds 95% on a benchmark dataset
- Verify the application runs on EU-hosted servers
Correct answer: Verify that candidates are informed they are interacting with an AI system, with Selenium asserting the disclosure UI is present and dismissible
The EU AI Act requires high-risk AI systems to provide transparency to affected individuals; Selenium can verify the mandatory disclosure notice is present and functional.
Question 5: Which Selenium test scenario validates compliance with WCAG 2.1 SC 2.5.3 (Label in Name) for a voice-input–enabled web application?
- Assert that each button's accessible name contains the same text as its visible label, so voice commands match the accessible name (Correct answer)
- Verify buttons have tooltip text on hover
- Check that all buttons have icons in addition to text labels
- Assert that ARIA labels override visible text on interactive elements
Correct answer: Assert that each button's accessible name contains the same text as its visible label, so voice commands match the accessible name
SC 2.5.3 requires the accessible name to include the visible label so speech recognition users can activate controls by saying what they see.
Question 6: A test team must provide evidence of automated testing for a PCI DSS v4.0 Requirement 6.4.3 audit. What does this requirement mandate?
- All payment page scripts must be authorized, have integrity verified, and be documented — Selenium tests should assert only approved script hashes are loaded (Correct answer)
- Payment pages must load in under 1 second
- All HTTP requests on payment pages must use TLS 1.3
- Payment page forms must not use autofill
Correct answer: All payment page scripts must be authorized, have integrity verified, and be documented — Selenium tests should assert only approved script hashes are loaded
PCI DSS v4.0 Requirement 6.4.3 requires organizations to manage and control all scripts on payment pages, including verifying their integrity via subresource integrity (SRI) hashes.
Question 7: When using Selenium to test a healthcare portal's compliance with HL7 FHIR security requirements, which test is most relevant?
- Assert that API responses to unauthenticated requests return 401 and do not expose any FHIR resource data (Correct answer)
- Verify that FHIR endpoints respond within 500ms
- Check that JSON responses include a Content-Type header
- Assert that patient names are displayed in uppercase
Correct answer: Assert that API responses to unauthenticated requests return 401 and do not expose any FHIR resource data
HL7 FHIR security requires proper authentication and authorization; unauthenticated requests must be rejected without leaking any protected health data.
Selenium Testing Framework Regulatory Frameworks & Compliance 5
A Selenium framework must support ITAR compliance for a defense contractor's web application.
What is the most critical test data management rule?