Software Testing Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: In DO-178C (airborne software testing), what does the term 'structural coverage analysis' primarily verify?
- That all user stories are implemented
- That test cases exercise the required code structure at the appropriate level (Correct answer)
- That performance benchmarks are met
- That the software compiles without warnings
Correct answer: That test cases exercise the required code structure at the appropriate level
Structural coverage analysis in DO-178C ensures test cases adequately exercise code structure (statement, decision, or MC/DC coverage) based on the software level.
Question 2: Under Sarbanes-Oxley (SOX) Section 404, what must software testers help verify regarding financial reporting systems?
- That the software is developed using agile methodology
- That internal controls over financial reporting are effective (Correct answer)
- That test automation covers 100% of code
- That system response time is under one second
Correct answer: That internal controls over financial reporting are effective
SOX Section 404 requires testing and attestation that internal controls over financial reporting are adequate and functioning effectively.
Question 3: What is 'traceability' in the context of compliance testing, and why is it required?
- Tracking which developer wrote each line of code
- Linking requirements to test cases to demonstrate coverage of compliance needs (Correct answer)
- Monitoring network traffic during testing
- Recording the physical location where testing occurred
Correct answer: Linking requirements to test cases to demonstrate coverage of compliance needs
Traceability links requirements to test cases and results, providing auditable evidence that all compliance requirements have been tested.
Question 4: A banking application is being tested for ADA (Americans with Disabilities Act) compliance. Which testing type is MOST relevant?
- Performance testing
- Accessibility testing (Correct answer)
- Integration testing
- Load testing
Correct answer: Accessibility testing
Accessibility testing verifies that software can be used by people with disabilities, which is required for ADA compliance in digital services.
Question 5: Under IEC 61508 (functional safety), what does SIL (Safety Integrity Level) determine in a testing context?
- The number of test cases required per feature
- The rigor and thoroughness of testing techniques required for the system (Correct answer)
- The minimum number of testers on the project
- The maximum number of defects allowed in production
Correct answer: The rigor and thoroughness of testing techniques required for the system
SIL levels (1-4) dictate which testing techniques are mandatory or highly recommended, with higher SIL requiring more rigorous validation methods.
Question 6: Which document is typically required in FDA-regulated software projects to demonstrate that the testing approach is fit for purpose before testing begins?
- Test summary report
- Validation protocol (Correct answer)
- Defect log
- Test automation framework documentation
Correct answer: Validation protocol
A validation protocol pre-defines the testing approach, acceptance criteria, and responsibilities to be approved before execution begins.
Question 7: In GDPR compliance testing, what does a 'right to erasure' (right to be forgotten) test verify?
- That users can delete their browser history
- That the system completely removes a user's personal data upon valid request (Correct answer)
- That log files rotate automatically
- That developers cannot access production data
Correct answer: That the system completely removes a user's personal data upon valid request
Right to erasure testing verifies that the system can identify and permanently delete all instances of a user's personal data across all storage locations.
Software Testing Regulatory Frameworks & Compliance 3
In DO-178C (airborne software testing), what does the term 'structural coverage analysis' primarily verify?