Software Testing Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A tester working on a medical device must ensure software meets ISO 14971 requirements. What does this standard primarily address?
- Software coding standards
- Risk management for medical devices (Correct answer)
- User interface design guidelines
- Network security protocols
Correct answer: Risk management for medical devices
ISO 14971 is the international standard for risk management of medical devices, requiring identification, evaluation, and control of risks throughout the software lifecycle.
Question 2: Under NIST SP 800-53, which testing activity satisfies the 'CA-8' control for penetration testing of federal information systems?
- Running automated unit tests
- Conducting authorized simulated attacks to identify exploitable vulnerabilities (Correct answer)
- Reviewing code for style compliance
- Executing performance benchmarks
Correct answer: Conducting authorized simulated attacks to identify exploitable vulnerabilities
NIST SP 800-53 CA-8 requires organizations to conduct penetration testing to identify weaknesses that could be exploited by adversaries.
Question 3: What distinguishes 'qualification testing' from standard system testing in aerospace and defense software contexts?
- Qualification testing only covers functional requirements
- Qualification testing demonstrates the software meets its stated requirements for regulatory approval (Correct answer)
- Qualification testing is performed only by the customer
- Qualification testing skips regression runs
Correct answer: Qualification testing demonstrates the software meets its stated requirements for regulatory approval
Qualification testing provides formal, documented evidence that software meets specified requirements for regulatory or contractual approval, not just internal quality checks.
Question 4: In SOC 2 (Service Organization Control 2) compliance, which testing validates the 'Availability' trust service criterion?
- Verifying that encryption keys are rotated quarterly
- Testing that systems meet agreed-upon uptime commitments and recovery objectives (Correct answer)
- Confirming that all users have multi-factor authentication
- Checking that software licenses are current
Correct answer: Testing that systems meet agreed-upon uptime commitments and recovery objectives
SOC 2 Availability testing verifies that systems are operational and accessible as committed, typically through uptime measurement and disaster recovery testing.
Question 5: Which testing challenge is MOST unique to compliance testing compared to standard functional testing?
- Finding defects before release
- Providing legally defensible documentation that requirements were met (Correct answer)
- Achieving high code coverage percentages
- Reducing the number of test cycles
Correct answer: Providing legally defensible documentation that requirements were met
Compliance testing must produce auditable, legally defensible evidence that regulatory requirements were verified, not just confirm the software works.
Question 6: A financial services firm must comply with FINRA Rule 3110. From a software testing perspective, what does this primarily require?
- Automated unit testing of trading algorithms
- Supervision and review of electronic communications and trading activity records (Correct answer)
- Penetration testing of customer-facing portals
- Load testing of high-frequency trading systems
Correct answer: Supervision and review of electronic communications and trading activity records
FINRA Rule 3110 requires firms to establish supervisory systems and verify that systems correctly capture, store, and make available all required communications and records.
Question 7: What is the role of an 'independent verification and validation (IV&V)' team in safety-critical software testing?
- To replace the development team's testing effort entirely
- To provide an unbiased assessment of software quality separate from the development organization (Correct answer)
- To perform only automated regression testing
- To manage the project schedule and budget
Correct answer: To provide an unbiased assessment of software quality separate from the development organization
IV&V teams provide objective, independent evaluation of safety-critical software, reducing the risk of bias when developers verify their own work.
Software Testing Regulatory Frameworks & Compliance 4
A tester working on a medical device must ensure software meets ISO 14971 requirements.
What does this standard primarily address?