Software Testing and Quality Control

To answer this question, the user needs to have a basic understanding of software testing and version control concepts.

The correct option is:

B. Pinning

Explanation:

Pinning is a software testing concept that allows the test set to be associated with the tests stored in a baseline. This ensures that the tests are executed against the correct version of the software, and that the test results are accurate and reproducible.

Baselining refers to the process of creating a baseline, which is a snapshot of the software at a specific point in time. Skimming and popping are not software testing or version control concepts, and are not relevant to this question.

Therefore, the answer is:

The Answer is: B. Pinning

Automated testing provides consistent results by eliminating human variability, allows test scripts to be reused across different scenarios, and increases productivity through faster execution. Options A, B, and D correctly identify these key advantages.

QTP identifies objects by their class (type) and a set of properties that uniquely distinguish them from other objects. Methods define what actions can be performed on the object but are not used for identification during recording.

The Development Team is responsible for fixing security vulnerabilities found during testing (B). They own the code and must implement fixes. The ASAP team identifies issues (A) but doesn't fix code. Testing Team finds vulnerabilities (C) but doesn't fix them. Project Management coordinates (D) but doesn't do remediation.

Penetration testing is the security-focused testing performed by ASAP teams during testing and rollout phase, simulating real-world attacks to identify exploitable vulnerabilities. Integration (A) and System (B) testing are functional testing types, while Unit (D) is done by developers.

TCS ASAP is a security framework that provides methodology for application security assessment and integrating security into the SDLC. It's not just testing (C), nor a product (D) - it's a comprehensive framework. Option A calls it a methodology which is partially true but less accurate than framework.

Whitelist data validation means only accepting data that matches a pre-approved list of valid values. This approach is more secure than blacklist validation because it explicitly defines what is permitted rather than trying to block every possible bad input. Option B describes blacklist validation (checking against known invalid values), which is the opposite of whitelisting.

Application security must be considered throughout the entire SDLC - from requirements and design through development, testing, and deployment. Focusing on only one phase (testing, development, or design) leaves vulnerabilities in other phases and is far less effective than continuous security.

The Development Team is responsible for fixing security vulnerabilities found during testing because they own the codebase and have the technical expertise to implement fixes. The ASAP Team identifies vulnerabilities, the Testing Team discovers them, and Project Management oversees the process, but none are responsible for the actual remediation work.

The ASAP Team performs penetration testing during the testing and rollout phase, which involves simulating real-world attacks to identify security weaknesses. Integration and system testing (options A and B) are typically done by the QA/testing team, while unit testing (option D) is done by developers during coding. Penetration testing is specifically focused on security.

The Development Team is responsible for fixing security vulnerabilities found during testing because they own the codebase and have the technical expertise to implement fixes. The ASAP Team identifies vulnerabilities, the Testing Team discovers them, and Project Management oversees the process, but none are responsible for the actual remediation work.

Penetration testing involves simulating real-world attacks on a system to identify security vulnerabilities before malicious actors can exploit them. The ASAP team specializes in security assessments, making penetration testing the most appropriate type of security-focused testing during the rollout phase.

Application security must be integrated throughout every phase of development. Thinking about security only during testing is too late, and focusing only on design or development misses crucial aspects. Security considerations should begin at requirements gathering and continue through deployment and maintenance.

White-box testing involves examining and testing the internal logical structures, code, and design of an application. Black-box testing focuses on inputs and outputs without knowledge of internal code structure. The key difference is access to and understanding of the internal workings.

White-box testing involves analyzing source code and internal logic. Using regular expressions and pattern databases to scan code for suspicious patterns is a static white-box technique, as it requires access to and examination of the underlying source code.