Selenium WebDriver Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Selenium WebDriver capability is used to enforce strict SSL certificate validation for compliance-sensitive environments?
- acceptInsecureCerts set to false (Correct answer)
- acceptInsecureCerts set to true
- sslCertificates set to strict
- tlsVerification set to enabled
Correct answer: acceptInsecureCerts set to false
Setting acceptInsecureCerts to false (the default) ensures the browser rejects invalid SSL certificates, which is required in compliance-sensitive testing environments.
Question 2: Under GDPR, when your Selenium test suite captures browser screenshots that may contain PII, what is the primary obligation?
- Store screenshots with encryption and apply data retention limits (Correct answer)
- Screenshots are exempt from GDPR because they are test artifacts
- PII in screenshots only matters if transmitted outside the EU
- Disable screenshots entirely in all GDPR-compliant test suites
Correct answer: Store screenshots with encryption and apply data retention limits
GDPR applies to all PII regardless of format, so screenshots containing personal data must be encrypted at rest and subject to retention policies.
Question 3: Section 508 compliance requires that web applications be accessible to users with disabilities. Which Selenium-compatible tool is most commonly used to automate Section 508 accessibility audits?
- axe-core via the axe-selenium integration (Correct answer)
- W3C Validator API via REST calls
- ChromeDriver's built-in accessibility scanner
- Selenium Grid's accessibility reporting module
Correct answer: axe-core via the axe-selenium integration
axe-core integrated with Selenium via the axe-selenium library is the industry-standard tool for automated Section 508 and WCAG accessibility auditing.
Question 4: A compliance policy prohibits automated tests from storing credentials in plain text. Which approach best satisfies this requirement in a Selenium test framework?
- Retrieve credentials at runtime from a secrets manager such as HashiCorp Vault (Correct answer)
- Base64-encode credentials in environment variables
- Hard-code credentials in a private repository visible only to the QA team
- Pass credentials via command-line arguments to the test runner
Correct answer: Retrieve credentials at runtime from a secrets manager such as HashiCorp Vault
A secrets manager retrieves credentials at runtime without persisting them in source code, environment files, or process arguments, satisfying plain-text storage prohibitions.
Question 5: PCI DSS prohibits storing sensitive authentication data after authorization. If Selenium tests target a payment flow, which practice is required?
- Use tokenized or masked card numbers in test data rather than real card data (Correct answer)
- Run payment tests only in production with monitoring enabled
- Encrypt real card numbers using AES-256 in the test database
- Store real card numbers in a VLAN-isolated Selenium Grid node
Correct answer: Use tokenized or masked card numbers in test data rather than real card data
PCI DSS forbids storing or transmitting real cardholder data in test environments; tokenized or test-specific card numbers must be used instead.
Question 6: HIPAA requires that Protected Health Information (PHI) not be exposed unnecessarily. When Selenium tests interact with a healthcare application, which measure is most critical?
- Use synthetic patient data generated specifically for testing (Correct answer)
- Limit test runs to business hours when IT staff can monitor activity
- Disable browser caching in the WebDriver options to prevent PHI retention
- Store test logs containing PHI on HIPAA-compliant cloud storage
Correct answer: Use synthetic patient data generated specifically for testing
The safest and required approach is using synthetic data so real PHI is never introduced into the test environment.
Question 7: Which W3C WebDriver specification feature helps ensure cross-browser test compliance by standardizing how browser automation commands are transmitted?
- The JSON Wire Protocol replacement with the W3C WebDriver HTTP API (Correct answer)
- Selenium RC's native browser plugin interface
- ChromeDriver's proprietary DevTools Protocol bridge
- The Selenium IDE export format for cross-browser scripts
Correct answer: The JSON Wire Protocol replacement with the W3C WebDriver HTTP API
The W3C WebDriver specification replaced the legacy JSON Wire Protocol with a standardized HTTP API, ensuring consistent cross-browser automation behavior.
Selenium WebDriver Regulatory Frameworks & Compliance 2
Which Selenium WebDriver capability is used to enforce strict SSL certificate validation for compliance-sensitive environments?