Software Testing Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Under CCPA (California Consumer Privacy Act), testing of a web application should verify which consumer-facing functionality?
- That the site loads in under 2 seconds
- That consumers can opt out of the sale of their personal information (Correct answer)
- That cookie consent banners display in English only
- That the site passes W3C markup validation
Correct answer: That consumers can opt out of the sale of their personal information
CCPA requires businesses to provide a clear mechanism for California consumers to opt out of the sale of their personal information, which must be tested for correct functionality.
Question 2: In a regulated pharmaceutical environment following GAMP 5 guidelines, what category would fully custom-developed software fall under?
- Category 1
- Category 3
- Category 4
- Category 5 (Correct answer)
Correct answer: Category 5
GAMP 5 Category 5 covers custom applications developed to meet specific user requirements, requiring the highest level of validation effort.
Question 3: What does 'boundary value testing' help verify in a compliance context for financial software?
- That the UI renders correctly at different screen resolutions
- That the system correctly handles regulatory thresholds such as transaction reporting limits (Correct answer)
- That the database handles concurrent users
- That encryption key length meets minimum standards
Correct answer: That the system correctly handles regulatory thresholds such as transaction reporting limits
In financial compliance, boundary value testing ensures systems correctly trigger regulatory actions (like suspicious activity reports) at mandated thresholds.
Question 4: Which FedRAMP testing requirement distinguishes cloud service providers seeking government contracts from standard commercial cloud vendors?
- Having 99.99% uptime SLA
- Undergoing a third-party security assessment against NIST 800-53 controls (Correct answer)
- Supporting single sign-on with Active Directory
- Providing on-premise deployment options
Correct answer: Undergoing a third-party security assessment against NIST 800-53 controls
FedRAMP requires cloud service providers to have their security controls independently assessed by an accredited Third Party Assessment Organization (3PAO).
Question 5: A test team is documenting their work on a nuclear plant control system under IEC 62645. What makes test documentation requirements here STRICTER than typical commercial software?
- Tests must be written in a formal mathematical notation
- Documentation must support post-incident forensic analysis and regulatory inspections for the plant's operational lifetime (Correct answer)
- All tests must be automated with zero manual testing
- Code coverage must reach exactly 100% statement coverage
Correct answer: Documentation must support post-incident forensic analysis and regulatory inspections for the plant's operational lifetime
Nuclear plant software documentation must withstand regulatory inspection and support incident investigation across decades of plant operation, far exceeding typical commercial retention needs.
Question 6: In compliance testing, what is a 'test witness' and when are they typically required?
- An automated monitoring tool that records test execution
- An authorized independent person who observes and signs off on critical test execution to ensure integrity (Correct answer)
- A customer representative who approves test cases before execution
- A second tester who re-runs all failed test cases
Correct answer: An authorized independent person who observes and signs off on critical test execution to ensure integrity
A test witness is an authorized observer (often a QA manager, client, or regulator representative) required in high-stakes compliance testing to attest that tests were executed as documented.
Question 7: When testing software for EU MDR (Medical Device Regulation) compliance, what must usability testing specifically demonstrate beyond basic UX feedback?
- That the software loads in under 3 seconds on all devices
- That use errors and hazardous situations arising from the user interface have been identified and mitigated (Correct answer)
- That the UI follows Google Material Design guidelines
- That the software passes all automated accessibility checks
Correct answer: That use errors and hazardous situations arising from the user interface have been identified and mitigated
EU MDR usability testing (following IEC 62366) must identify how user interface design could lead to use errors that pose safety risks, not just assess satisfaction.
Software Testing Regulatory Frameworks & Compliance 5
Under CCPA (California Consumer Privacy Act), testing of a web application should verify which consumer-facing functionality?