Software Testing and Quality Control

Component testing, also called unit or module testing, is performed by developers and requires planned completion criteria. It absolutely involves regression testing to ensure changes to one component don't break others. Statement D is false because regression testing is a standard part of component testing.

Finding faults during the planning phase is most cost-effective because preventing defects early avoids expensive rework later. While design review also catches issues early, planning establishes the entire testing strategy and can prevent entire categories of faults. Planning is considered most cost-effective because it enables prevention at the earliest stage.

While useful technical skills, testers don't necessarily need to write production software. More critical are soft skills like diplomacy for reporting issues, attention to detail for thorough testing, and reliability for consistent execution. Technical writing skills for test documentation are more important than programming ability for most testers.

A function/test matrix maps software functions to their corresponding tests, tracking test coverage and execution status. It is typically included in project status reports to communicate progress. It is not exclusively an interim, final, or high-level management report.

The primary difference is cultural - varying communication styles, business practices, and expectations across countries affect testing processes and outcomes. Other options like resource allocation (C) or relinquishing control (D) are contract-specific, not geography-specific.

RPT (Rational Performance Tester) is a performance and load testing tool, not a test management tool. RTH-Turbo, Bugzilla, and Quality Center (QC) are designed to manage the testing process, test cases, and defects.

White Box Testing techniques involve analyzing internal code structure, logic, and implementation. Equivalence Partitioning, Boundary Value Analysis, and Error Guessing are all Black Box Testing techniques that focus on inputs and outputs without examining internal code. Therefore, 'None of the above' is correct as none of these are White Box techniques.

Quality Control is defined as testing the software or product for its intended behavior - it involves actual testing activities to find defects. Quality Assurance focuses on process improvement and preventing defects. Option A correctly defines Quality Control as product testing for intended behavior.

Penetration Testing is specifically conducted to determine whether software is vulnerable to attacks by simulating real-world attacks. While Security Testing is a broader category, Penetration Testing is the specific technique mentioned for vulnerability assessment. Installation Testing and Recovery Testing serve different purposes.

The development team is responsible for fixing security vulnerabilities discovered during testing. While the ASAP or testing team identifies issues through security assessments, the developers who wrote the code must remediate them. This ensures proper understanding of the codebase and appropriate fixes.

The ASAP team conducts integration testing during the testing and rollout phase to verify that security controls work correctly when different components and systems interact. This ensures security is maintained as components are integrated.

TCS ASAP is a comprehensive security framework that provides methodology, guidelines, and processes for integrating security throughout the application development lifecycle. It is not a product or just testing, but a structured approach to application security.

White-box testers see source code and can design tests targeting specific internal logic paths. Black-box testers only see inputs and outputs like external users. Options A, B, and C are incorrect - tester independence, approach strategy, and business unit involvement don't define the difference.

White-box testing involves analyzing source code directly to find vulnerabilities. Regex-based scanning is a static white-box technique that examines code patterns. Black-box (B) tests without code access, and grey-box (A) combines limited internal knowledge with external testing.

The Development Team owns the codebase and is responsible for implementing fixes for security vulnerabilities discovered during testing. While testing teams identify issues, remediation requires developers to modify the actual source code.