TS Safety Protocols & Best Practices 3 — Questions and Answers
Question 1: When conducting load testing on a shared network, which safety precaution is MOST important?
- Running load tests during peak business hours for realistic conditions
- Notifying all stakeholders and scheduling tests during off-peak windows (Correct answer)
- Maximizing traffic generation to find the absolute system limit immediately
- Using the same credentials as production users for accurate simulation
Correct answer: Notifying all stakeholders and scheduling tests during off-peak windows
Coordinating with stakeholders and scheduling during off-peak hours prevents load tests from degrading service for real users.
Question 2: What is the PRIMARY risk of using production credentials in a test environment?
- Test results may be less accurate than with synthetic credentials
- Credential exposure in less-secure test environments can compromise production systems (Correct answer)
- Production credentials typically have insufficient permissions for testing
- Using production credentials violates software licensing agreements
Correct answer: Credential exposure in less-secure test environments can compromise production systems
Test environments generally have weaker security controls, so production credentials stored or logged there can be harvested and used to attack production.
Question 3: A test specialist is asked to test a third-party API integration. Which safety step should be completed BEFORE testing begins?
- Test directly against the live third-party API to ensure real-world accuracy
- Obtain written authorization from the third-party vendor to conduct testing (Correct answer)
- Skip authorization since it is an integration test, not a security test
- Use automated tools to brute-force the API endpoints
Correct answer: Obtain written authorization from the third-party vendor to conduct testing
Testing against third-party APIs without written authorization may violate terms of service and could have legal consequences.
Question 4: Which log management practice BEST supports safety and auditability in a test environment?
- Deleting logs after each test cycle to free up storage space
- Retaining logs with controlled access for a defined period aligned to policy (Correct answer)
- Granting all team members unrestricted access to all logs
- Logging only failed test cases to reduce log volume
Correct answer: Retaining logs with controlled access for a defined period aligned to policy
Retaining logs with access controls and a defined retention period ensures accountability and supports incident investigation while protecting sensitive data.
Question 5: During regression testing, a tester finds that a previously fixed security vulnerability has reappeared. This is BEST described as:
- A false positive that should be dismissed
- A regression defect that must be escalated and re-remediated (Correct answer)
- An expected side effect of continuous integration
- A configuration issue unrelated to the original fix
Correct answer: A regression defect that must be escalated and re-remediated
A reappearing previously-fixed vulnerability is a security regression defect that must be re-escalated and fixed before release.
Question 6: What is the purpose of a 'test data management policy' in the context of safety protocols?
- To maximize the volume of test data available for automation
- To govern how test data is created, stored, used, and disposed of safely (Correct answer)
- To ensure developers can freely access all test datasets
- To standardize test data formats across programming languages
Correct answer: To govern how test data is created, stored, used, and disposed of safely
A test data management policy defines safe lifecycle practices for test data, reducing risks related to sensitive data exposure and regulatory non-compliance.
Question 7: A test specialist is working remotely and needs to access a secure test environment. The SAFEST connection method is:
- Using a personal home Wi-Fi network without additional controls
- Connecting via an approved VPN with multi-factor authentication (Correct answer)
- Sharing a colleague's VPN credentials for convenience
- Accessing the environment directly via an unsecured public network
Correct answer: Connecting via an approved VPN with multi-factor authentication
An approved VPN with MFA provides encrypted, authenticated access, significantly reducing the risk of credential theft or eavesdropping.
TS Safety Protocols & Best Practices 3
When conducting load testing on a shared network, which safety precaution is MOST important?