Selenium WebDriver Regulatory Frameworks & Compliance 4 β Questions and Answers
Question 1: FedRAMP authorization requires that test tools used against government cloud systems meet specific security controls. Which ChromeDriver argument helps satisfy the SC-28 (Protection of Information at Rest) control during local test runs?
- Using a user-data-dir on an encrypted volume and clearing it after each test run (Correct answer)
- --disable-gpu to prevent GPU memory caching of sensitive data
- --incognito to ensure browser data is stored in a temporary folder
- --no-sandbox to allow ChromeDriver to access encrypted file systems
Correct answer: Using a user-data-dir on an encrypted volume and clearing it after each test run
Storing the Chrome user profile directory on an encrypted volume and wiping it post-run satisfies the at-rest protection control by ensuring no sensitive data persists unencrypted.
Question 2: OWASP's Testing Guide recommends verifying clickjacking protection. Which Selenium-based HTTP header assertion confirms that a page is protected against clickjacking?
- Assert that the server returns X-Frame-Options: DENY or Content-Security-Policy with frame-ancestors 'none' (Correct answer)
- Assert that the page contains no iframe elements using findElements(By.tagName('iframe'))
- Assert that the browser console shows no mixed content warnings
- Assert that document.referrer is empty after navigating to the page
Correct answer: Assert that the server returns X-Frame-Options: DENY or Content-Security-Policy with frame-ancestors 'none'
X-Frame-Options or the CSP frame-ancestors directive instructs browsers to refuse to render the page in a frame, preventing clickjacking attacks.
Question 3: A compliance requirement mandates that automated tests do not retain session tokens after test completion. Which Selenium teardown practice satisfies this requirement?
- Call driver.manage().deleteAllCookies() and execute localStorage.clear() in an @AfterEach method (Correct answer)
- Close the browser window using driver.close() without calling driver.quit()
- Navigate to about:blank before ending the test to clear the current page session
- Use driver.navigate().refresh() to invalidate the session server-side
Correct answer: Call driver.manage().deleteAllCookies() and execute localStorage.clear() in an @AfterEach method
Deleting all cookies and clearing localStorage in a teardown hook removes session tokens from the browser before the driver session ends.
Question 4: WCAG 2.1 Success Criterion 1.4.3 requires a minimum color contrast ratio of 4.5:1 for normal text. Which Selenium-based approach can automate this check?
- Use axe-core or a contrast analysis library after retrieving computed color values via JavaScript execution (Correct answer)
- Assert that CSS color values are never set to shades of gray
- Use driver.findElement().getCssValue('color') and compare to a whitelist of accessible colors
- Capture a screenshot and submit it to a manual review queue for contrast validation
Correct answer: Use axe-core or a contrast analysis library after retrieving computed color values via JavaScript execution
axe-core or dedicated contrast libraries calculate the actual contrast ratio from computed foreground and background colors, providing an automated WCAG 1.4.3 assertion.
Question 5: Under COPPA, websites must not collect personal information from children under 13 without parental consent. Which Selenium test verifies that an age gate prevents underage access?
- Enter a birth year that makes the user under 13, submit, and assert that access is denied with an appropriate message (Correct answer)
- Verify that a date-of-birth field is present on the registration form
- Check that the terms of service mention COPPA compliance
- Assert that the minimum age field has a min attribute set to 13
Correct answer: Enter a birth year that makes the user under 13, submit, and assert that access is denied with an appropriate message
Functionally simulating an underage submission and asserting the denial response validates that the age gate enforcement logic actually works end-to-end.
Question 6: NIST SP 800-53 control AC-11 requires automatic session lock after a period of inactivity. How would a Selenium test validate this control for a web application?
- Authenticate, wait idle for the configured timeout period, then attempt an authenticated action and assert a re-authentication prompt appears (Correct answer)
- Authenticate, call driver.manage().timeouts().implicitlyWait() with the timeout value, then assert the session is active
- Authenticate and immediately assert that a session-timeout cookie with the correct max-age is present
- Authenticate, send a large number of no-op requests to keep the session alive, then verify the timeout does not trigger
Correct answer: Authenticate, wait idle for the configured timeout period, then attempt an authenticated action and assert a re-authentication prompt appears
Waiting through the full inactivity period and then verifying that a protected action triggers re-authentication is the only way to functionally validate the session lock control.
Question 7: An organization subject to SOX requires that only authorized personnel can modify financial data. Which Selenium test pattern validates role-based access control for a CFO-only financial report?
- Log in as a non-CFO user and assert that the financial report URL returns a 403 or redirects to an access-denied page (Correct answer)
- Log in as a CFO user and verify that all report data is visible and accurate
- Assert that the financial report link is hidden in the navigation for non-CFO users
- Verify that the report page includes an authentication header in its HTTP response
Correct answer: Log in as a non-CFO user and assert that the financial report URL returns a 403 or redirects to an access-denied page
Testing that an unauthorized role receives a 403 or access-denied response validates server-side enforcement of the access control, not just UI hiding.
Selenium WebDriver Regulatory Frameworks & Compliance 4
FedRAMP authorization requires that test tools used against government cloud systems meet specific security controls.
Which ChromeDriver argument helps satisfy the SC-28 (Protection of Information at Rest) control during local test runs?