Software Testing and Quality Control

The ASAP team conducts integration testing during the testing and rollout phase to verify that security controls work correctly when different components and systems interact. This ensures security is maintained as components are integrated.

TCS ASAP is a comprehensive security framework that provides methodology, guidelines, and processes for integrating security throughout the application development lifecycle. It is not a product or just testing, but a structured approach to application security.

Logging page load times for all application pages is inappropriate for continuous logging because it generates excessive volume of low-value data, degrades performance, and makes it difficult to find meaningful security events. Continuous logging should focus on security-relevant events like logins, lockouts, and critical transactions.

White-box testers see source code and can design tests targeting specific internal logic paths. Black-box testers only see inputs and outputs like external users. Options A, B, and C are incorrect - tester independence, approach strategy, and business unit involvement don't define the difference.

White-box testing involves analyzing source code directly to find vulnerabilities. Regex-based scanning is a static white-box technique that examines code patterns. Black-box (B) tests without code access, and grey-box (A) combines limited internal knowledge with external testing.

The Development Team owns the codebase and is responsible for implementing fixes for security vulnerabilities discovered during testing. While testing teams identify issues, remediation requires developers to modify the actual source code.

Penetration testing involves simulating real-world attacks to identify security weaknesses before deployment. This active testing approach is typically performed by security teams during the testing and rollout phase to validate defenses.

TCS ASAP is a proprietary security framework that provides structured methodology for application security assessment. It defines processes, engagement models, and best practices for integrating security into the software development lifecycle.

Heuristic evaluation is a usability testing method performed by experts to identify design flaws. While best conducted iteratively throughout the design lifecycle, it functions as an evaluation and testing process to critique interfaces and prototypes before public release.

When an end user deletes a Live object, it is hidden (not completely deleted) if the corresponding deletion properties are properly configured. This allows for recovery or controlled deletion behavior. Special properties must be set for this to work - it won't happen automatically.

Exception Handler activities in DataStage are triggered by exception conditions and do not require input links. They can exist as standalone activities that execute when an exception occurs.

The Exception Handler activity in DataStage is designed to catch and handle exceptions that occur during job execution. It does not require any input links to function - its purpose is to handle errors that might occur in other stages. The minimum number of input links required is zero. Therefore option A (0) is correct.

Multi-step operations record complex application flows requiring multiple sequential requests to reach a specific state or functionality. This includes multi-page forms, wizards, workflows where state changes across requests, or any scenario requiring navigation through several pages. It's not just for login sequences or parameter manipulation - it captures any complex user journey.

AppScan operates as a black-box tool, testing applications from the outside by sending HTTP requests and analyzing responses without accessing source code or internal state. It simulates an external attacker's perspective.

Before testing, you must communicate (notify users and administrators so they're aware of potential disruptions), protect data (backup the database to enable recovery if the test causes issues), and document (though not listed here, documentation is also critical). SMTP servers should remain running unless specifically testing email handling. The question tests standard test preparation protocols.