Software Testing and Security Testing Fundamentals

TamperIE modifies requests to test input validation. CookieMonitor examines cookie data for security issues. SQL Profiler helps analyze SQL injection vulnerabilities. All three are legitimate security testing tools.

Option B attempts to drop a table using SQL injection. Option C uses 'OR 1=1--' to bypass authentication. Option A has mismatched quotes and won't work as written. 'All the above' (D) is incorrect since A is flawed.

Penetration testing actively exploits vulnerabilities. Vulnerability testing identifies security weaknesses. Risk assessment evaluates potential impact and likelihood. Security testing encompasses all these activities.

Confidentiality ensures data is only accessible to authorized parties. Integrity guarantees data is not altered without authorization. Availability ensures systems and data are accessible when needed. These are the three pillars of the CIA triad.

JavaScript, VBScript, ActiveX, and Flash are all client-side scripting technologies that can execute code in browsers, making them vectors for XSS attacks. SQL Server Management Studio is a database administration tool, not a browser scripting platform. Web services themselves don't execute XSS - the client that consumes them does.

Cross Site Scripting (XSS) attacks allow malicious scripts to be injected into web pages viewed by other users. These scripts can access cookies (enabling session theft), hijack user accounts by stealing authentication credentials, execute malicious ActiveX or Flash content (in legacy systems), and force downloads of malicious software. All listed outcomes are possible XSS attack vectors.

Boundary Value Analysis evaluates boundaries and values just outside them. For a valid range of 1 to 99, the boundary points are the lower limit (1) and upper limit (99). The immediate invalid values are 0 (below 1) and 100 (above 99), yielding the correct set of 0, 1, 99, and 100.

Component testing focuses on individual software components. Memory leak checking, robustness testing, and branch coverage are all component-level testing activities. Decision table testing is a system-level or acceptance testing technique that examines complex business logic and decision rules, not component behavior.

Contract and regulation testing verifies that software meets contractual obligations and regulatory requirements. This is a key part of acceptance testing, which validates that the system meets business and legal requirements before it's accepted by stakeholders. It's not system testing (functional verification), integration testing (interface verification), or smoke testing (basic stability check).

External failure costs are incurred when defects are discovered by customers after product release. Maintenance releases to patch bugs and technical assistance centers to help users deal with post-release issues are classic examples of external failure costs. Internal failure, appraisal, and prevention costs occur prior to shipping.

An effective facilitator manages dominating individuals non-confrontationally. Waiting for a pause, acknowledging their input, and actively inviting other team members to speak redirects the discussion smoothly. Confrontation, changing topics abruptly, or expressing opposing views to provoke others can disrupt the meeting's collaborative atmosphere.

With fixed delivery dates and quality standards, adding resources (options B, D) or overtime (option C) often delays further due to ramp-up time and coordination overhead (Brooks' Law). Scope reduction by eliminating unimplemented requirements (option A) is the most viable approach to recover schedule while maintaining quality of the remaining features.

Procedures and standards within individual workbenches ensure consistent and correct output production. Tools are instruments used, while techniques are methods applied - but procedures and standards govern HOW work is done to achieve right outputs.

Equivalence partitioning divides input and output domains into classes where tests from one class represent all others, achieving coverage. Boundary value analysis focuses on edge values, decision tables handle complex logic, and state transition tests model state changes.

Test design techniques serve the dual purpose of identifying test conditions (what to test) AND identifying specific test cases (how to test). Options A and B are incomplete - focusing on only one aspect. Option D incorrectly suggests 'or' instead of 'and'.

Informal reviews are characterized by their low cost and minimal documentation - their primary purpose is indeed to provide an inexpensive way to gain some benefit from review. While learning and defect finding can occur, these are better characterized as outcomes rather than the main purpose.

In a formal review process, the Scribe (or Recorder) is specifically responsible for documenting all issues, problems, and open points identified during the review meeting. The Moderator facilitates the discussion, Reviewers analyze the work product, and the Author created the document under review.

Test completion criteria define when testing is complete - typically based on coverage, risk reduction, or other exit criteria. Options A and B refer to test specification and input generation, not completion. Option C confuses planning completion with test execution completion.

To answer this question, the user needs to understand the concept of configuration management, which is the process of identifying, organizing, and controlling the changes made to software, hardware, or any other system throughout its lifecycle.

A. Status accounting of configuration items: This is a part of configuration management, which involves tracking the status of various configuration items and their version history.

B. Auditing conformance to ISO9001: This is not a part of configuration management. ISO9001 is a quality management standard that focuses on ensuring consistent quality of products and services. While configuration management is an important aspect of quality management, auditing to ISO9001 is not directly related to it.

C. Identification of test versions: This is a part of configuration management, which involves tracking the different versions of software or hardware throughout the testing phase.

D. Record of changes to documentation over time: This is a part of configuration management, which involves tracking the changes made to the documentation of the system throughout its lifecycle.

Therefore, the answer is:

The Answer is: B