TS Standards & Compliance 3 — Questions and Answers
Question 1: In safety-critical systems, what does 'SIL' stand for and what does it determine?
- Software Integration Level — the number of integration tests required
- Safety Integrity Level — the required risk reduction for a safety function (Correct answer)
- System Inspection Limit — the maximum defect density allowed
- Standard Implementation Layer — the testing protocol to follow
Correct answer: Safety Integrity Level — the required risk reduction for a safety function
Safety Integrity Level (SIL), defined in IEC 61508, quantifies the required risk reduction that a safety function must achieve.
Question 2: A tester working on a PCI-DSS project must verify that cardholder data is masked in test environments. Which control objective does this address?
- Maintain a vulnerability management program
- Protect cardholder data (Correct answer)
- Implement strong access control measures
- Regularly monitor and test networks
Correct answer: Protect cardholder data
PCI-DSS Requirement 3 (Protect stored cardholder data) mandates that real cardholder data must never be used in test environments without proper masking or tokenization.
Question 3: Which term describes the process of confirming that a software product fulfills its intended use when placed in its intended environment?
- Verification
- Validation (Correct answer)
- Qualification
- Certification
Correct answer: Validation
Validation answers 'Are we building the right product?' by confirming the product meets user needs in its real operational context.
Question 4: Under IEC 62304 (medical device software), which lifecycle class requires the MOST rigorous testing including full traceability?
- Class A
- Class B
- Class C (Correct answer)
- Class D
Correct answer: Class C
IEC 62304 Class C applies to software where failure could result in death or serious injury, requiring the most complete testing and traceability.
Question 5: A test specialist notices that a test procedure deviates from the organization's documented testing standard. What should they do FIRST?
- Proceed with testing and note the deviation in the defect log
- Obtain formal approval for the deviation or waiver before proceeding (Correct answer)
- Rewrite the standard to match current practice
- Escalate immediately to senior management without further analysis
Correct answer: Obtain formal approval for the deviation or waiver before proceeding
Process deviations require formal approval or a waiver to maintain compliance; proceeding without authorization violates the audit trail.
Question 6: Which aspect of the Capability Maturity Model Integration (CMMI) for Development directly relates to test process improvement?
- Organizational Process Focus (OPF)
- Verification (VER) and Validation (VAL) process areas (Correct answer)
- Requirements Management (REQM)
- Configuration Management (CM)
Correct answer: Verification (VER) and Validation (VAL) process areas
The Verification and Validation process areas in CMMI-DEV directly govern testing activities, including test planning, peer reviews, and product validation.
Question 7: Which FDA regulation governs software validation requirements for medical devices sold in the United States?
- 21 CFR Part 11
- 21 CFR Part 820 (Correct answer)
- 21 CFR Part 50
- 21 CFR Part 312
Correct answer: 21 CFR Part 820
21 CFR Part 820 (Quality System Regulation) requires that software used in medical devices undergo validation, including documented test evidence.
TS Standards & Compliance 3
In safety-critical systems, what does 'SIL' stand for and what does it determine?