Selenium WebDriver Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: GDPR Article 17 grants users the right to erasure. Which Selenium test scenario validates that a 'Delete My Account' feature is compliant?
- Delete the account via the UI, then assert that re-logging in and querying the user's data both return not-found responses (Correct answer)
- Assert that a 'Delete My Account' button is present and clickable on the profile page
- Verify that the deletion confirmation email is sent within 30 days
- Assert that the account deletion request is logged in the audit trail
Correct answer: Delete the account via the UI, then assert that re-logging in and querying the user's data both return not-found responses
End-to-end verification that the account and associated data are unreachable after deletion confirms that the erasure right is functionally implemented.
Question 2: Which Selenium WebDriver configuration ensures that browser proxy settings route test traffic through a compliance-mandated network inspection gateway?
- Set a Proxy object with proxyType MANUAL and the gateway address in httpProxy and sslProxy fields (Correct answer)
- Pass --proxy-server as a ChromeOptions argument with the gateway URL
- Set the HTTPS_PROXY environment variable before launching the WebDriver process
- Configure the proxy in the operating system network settings before running tests
Correct answer: Set a Proxy object with proxyType MANUAL and the gateway address in httpProxy and sslProxy fields
Using the W3C-standard Proxy capability with MANUAL type and explicit httpProxy/sslProxy fields is the portable, specification-compliant way to route WebDriver traffic through a gateway.
Question 3: A security compliance policy mandates that automated tests validate HTTP Strict Transport Security (HSTS) headers. Which Selenium-based approach correctly checks for HSTS?
- Execute an HTTP request via a proxy or logging driver, capture response headers, and assert Strict-Transport-Security is present with a sufficient max-age (Correct answer)
- Assert that driver.getCurrentUrl() returns a URL beginning with 'https://'
- Check that the browser padlock icon is displayed using a screenshot comparison
- Verify that no mixed content warnings appear in the browser console log
Correct answer: Execute an HTTP request via a proxy or logging driver, capture response headers, and assert Strict-Transport-Security is present with a sufficient max-age
HSTS is an HTTP response header, so it must be captured at the network level via a proxy or logging driver since WebDriver does not expose raw response headers natively.
Question 4: ISO 27001 Annex A control A.12.6.1 requires timely identification of technical vulnerabilities. How should a Selenium test suite be maintained to support this control?
- Regularly update Selenium, browser drivers, and all dependencies, and include dependency scanning in the CI pipeline (Correct answer)
- Run Selenium tests daily to detect any new application vulnerabilities automatically
- Pin all Selenium library versions to prevent unexpected changes from introducing vulnerabilities
- Restrict Selenium Grid access to the internal network to reduce the attack surface
Correct answer: Regularly update Selenium, browser drivers, and all dependencies, and include dependency scanning in the CI pipeline
Keeping dependencies current and scanning for known CVEs in the CI pipeline directly addresses the technical vulnerability management control in ISO 27001.
Question 5: A compliance audit requires evidence that automated Selenium tests ran against the correct environment (production vs. staging). Which technique provides the most reliable verification?
- Assert the base URL and environment identifier at the start of each test and include them in the test report (Correct answer)
- Rely on the CI/CD pipeline configuration file to document which environment was targeted
- Capture the browser window title, which typically shows the environment name
- Store the target URL in a README alongside the test results
Correct answer: Assert the base URL and environment identifier at the start of each test and include them in the test report
In-test assertions against the base URL that are captured in the test report create tamper-evident, verifiable evidence that the test ran against the declared environment.
Question 6: WCAG 2.1 Success Criterion 2.1.1 requires all functionality to be operable via keyboard. Which Selenium test pattern validates that a dropdown menu is fully keyboard accessible?
- Focus the trigger element, press Enter to open the menu, navigate items with arrow keys, press Enter to select, and assert the correct selection (Correct answer)
- Assert that all dropdown items have href attributes allowing direct keyboard navigation
- Use Actions.moveToElement() to hover over each item and verify it becomes visible
- Check that the dropdown has tabindex='0' on its container element
Correct answer: Focus the trigger element, press Enter to open the menu, navigate items with arrow keys, press Enter to select, and assert the correct selection
Simulating the complete keyboard interaction flow—open, navigate, select—and asserting the result validates end-to-end keyboard operability as required by WCAG 2.1.1.
Question 7: When a Selenium test suite is used as part of a compliance testing program, which document type formally defines which regulations the tests are designed to validate?
- A Compliance Requirements Traceability Matrix mapping test IDs to regulatory controls (Correct answer)
- A test plan document listing all test cases and their expected results
- A risk register identifying the highest-priority test scenarios
- A defect report linking failed tests to the responsible development team
Correct answer: A Compliance Requirements Traceability Matrix mapping test IDs to regulatory controls
A Requirements Traceability Matrix explicitly maps each test to the specific regulatory control it validates, providing auditors with clear evidence of coverage.
Selenium WebDriver Regulatory Frameworks & Compliance 5
GDPR Article 17 grants users the right to erasure.
Which Selenium test scenario validates that a 'Delete My Account' feature is compliant?