Software Testing and Quality Control

Penetration testing involves simulating real-world attacks to identify security weaknesses before deployment. This active testing approach is typically performed by security teams during the testing and rollout phase to validate defenses.

TCS ASAP is a proprietary security framework that provides structured methodology for application security assessment. It defines processes, engagement models, and best practices for integrating security into the software development lifecycle.

Heuristic evaluation is a usability testing method performed by experts to identify design flaws. While best conducted iteratively throughout the design lifecycle, it functions as an evaluation and testing process to critique interfaces and prototypes before public release.

AppScan operates as a black-box tool, testing applications from the outside by sending HTTP requests and analyzing responses without accessing source code or internal state. It simulates an external attacker's perspective.

Before testing, you must communicate (notify users and administrators so they're aware of potential disruptions), protect data (backup the database to enable recovery if the test causes issues), and document (though not listed here, documentation is also critical). SMTP servers should remain running unless specifically testing email handling. The question tests standard test preparation protocols.

Security vulnerabilities are defects in code that must be fixed by the team that owns the codebase. The Development Team writes and maintains the application code, so they bear responsibility for implementing remediation. Testing teams (including specialized security teams like ASAP) identify issues but do not fix them.

During the testing and rollout phase, the ASAP team conducts penetration testing to identify exploitable vulnerabilities in the running application. Penetration testing simulates real-world attacks by attempting to actively exploit security flaws. Unit testing is done by developers during coding, system and integration testing are QA activities - penetration testing is the specialized security testing performed by the ASAP team.

TCS ASAP is a security framework that provides a structured methodology for integrating security throughout the application development lifecycle. While it is TCS proprietary (option A) and involves security testing activities (option C), neither captures the full scope - it's an overarching framework providing structure, processes, and guidance, not just a testing service or product.

Application security must be considered throughout the entire software development lifecycle, not just at one phase. Thinking about security only during testing, development, or design is insufficient because vulnerabilities can be introduced at any stage. A holistic approach from requirements through deployment ensures security is built in rather than bolted on later.

PMD is a well-known open source static code analysis tool for Java that checks for common programming flaws and unused code. It uses a ruleset-based approach to identify potential problems like unused variables, empty catch blocks, or inefficient object creation. Ounce and Fortify are commercial static analysis tools, while DevInspect is not a recognized static analyzer.

White-box testing (also called glass-box or clear-box) examines internal program structures, code, logic flows, and algorithms. Black-box testing treats software as a opaque box, testing only inputs and outputs without seeing internal code. The color refers to visibility - white means you can see inside, black means you cannot.

Scanning source code with regex patterns to identify suspicious functions, inputs, or outputs is inherently a white-box testing technique - it requires access to and analysis of internal code. Black-box testing examines only external behavior without code access, and gray-box testing combines partial internal knowledge with external testing.

QTP/UFT is primarily designed for regression testing, which involves repeatedly running existing automated tests to verify that previously working functionality still works after code or configuration changes. While it can do GUI testing and web testing, its main strength and industry use case is automating regression test suites.

The Object Spy feature in QTP/UFT is used to view and analyze the properties, methods, and hierarchy of test objects and runtime objects in the application under test. While it helps with object identification, its primary purpose is to inspect object properties and methods, not to perform identification or verification operations.

A checkpoint compares a specified property's current value during test execution with its expected stored value. Output values capture data for later use, while 'Compare the object property' is not a standard QTP feature.