Software Testing and Quality Control

Security vulnerabilities are defects in code that must be fixed by the team that owns the codebase. The Development Team writes and maintains the application code, so they bear responsibility for implementing remediation. Testing teams (including specialized security teams like ASAP) identify issues but do not fix them.

During the testing and rollout phase, the ASAP team conducts penetration testing to identify exploitable vulnerabilities in the running application. Penetration testing simulates real-world attacks by attempting to actively exploit security flaws. Unit testing is done by developers during coding, system and integration testing are QA activities - penetration testing is the specialized security testing performed by the ASAP team.

TCS ASAP is a security framework that provides a structured methodology for integrating security throughout the application development lifecycle. While it is TCS proprietary (option A) and involves security testing activities (option C), neither captures the full scope - it's an overarching framework providing structure, processes, and guidance, not just a testing service or product.

Application security must be considered throughout the entire software development lifecycle, not just at one phase. Thinking about security only during testing, development, or design is insufficient because vulnerabilities can be introduced at any stage. A holistic approach from requirements through deployment ensures security is built in rather than bolted on later.

PMD is a well-known open source static code analysis tool for Java that checks for common programming flaws and unused code. It uses a ruleset-based approach to identify potential problems like unused variables, empty catch blocks, or inefficient object creation. Ounce and Fortify are commercial static analysis tools, while DevInspect is not a recognized static analyzer.

White-box testing (also called glass-box or clear-box) examines internal program structures, code, logic flows, and algorithms. Black-box testing treats software as a opaque box, testing only inputs and outputs without seeing internal code. The color refers to visibility - white means you can see inside, black means you cannot.

Scanning source code with regex patterns to identify suspicious functions, inputs, or outputs is inherently a white-box testing technique - it requires access to and analysis of internal code. Black-box testing examines only external behavior without code access, and gray-box testing combines partial internal knowledge with external testing.

The OWB Design Browser Client is a web-based interface for viewing metadata objects, generating reports, and performing lineage analysis (tracing data flow) and impact analysis (determining effects of changes). It provides read-only access to the metadata repository. The OWB Client is for design, Repository is storage, Runtime tools are for execution.

The OWB Deployment Manager is the runtime component responsible for deploying mapping definitions and other objects to the target environment, and for executing the deployed ETL processes. It manages the connection between the design-time repository and the runtime execution engine, handling both deployment and execution of data integration workflows. The Repository stores metadata, the Client is for design, and there is no separate Mapping Compiler component.

In automated testing with QTP/UFT, Add-Ins must be installed and loaded to enable the tool to recognize and interact with test objects of specific technologies in the target application. Add-Ons, Add-Froms, and Add-tools are incorrect terms and do not represent the required environment packages.

QTP/UFT is primarily designed for regression testing, which involves repeatedly running existing automated tests to verify that previously working functionality still works after code or configuration changes. While it can do GUI testing and web testing, its main strength and industry use case is automating regression test suites.

The Object Spy feature in QTP/UFT is used to view and analyze the properties, methods, and hierarchy of test objects and runtime objects in the application under test. While it helps with object identification, its primary purpose is to inspect object properties and methods, not to perform identification or verification operations.

The Object Spy in HP/Micro Focus UFT allows users to view both test object properties (static properties stored in the repository) and run-time object properties (dynamic properties of the actual object in the running application) along with their values.

GetROProperty (Get Runtime Object Property) retrieves the current actual property value of objects from the application during runtime. GetTOProperty gets test object properties (descriptive), while GetVisibleText retrieves visible text content.

A checkpoint compares a specified property's current value during test execution with its expected stored value. Output values capture data for later use, while 'Compare the object property' is not a standard QTP feature.