Free Certified Software Quality Engineer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Software Quality Engineer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A software quality engineer proposes reviewing security requirements during design instead of waiting for release testing. What organizational benefit best supports this timing?

   1. A. Lower total effort to achieve the same security level
   2. B. Higher measured throughput from reducing test execution
   3. C. Lower procurement expense from consolidating suppliers
   4. D. Higher availability from increasing production capacity

   Answer: A

   Explanation: NIST states, "the earlier in the SDLC that security is addressed, the less effort and cost is ultimately required to achieve the same level of security." Early quality work reduces later remediation effort; it does not establish the other proposed operational benefits.

   Reference: Secure Software Development Framework (SSDF) Version 1.1 — Section 1, p. 1

2. 2A quality engineer is defining software quality goals for a regulated business product. Which basis should guide those goals?

   1. A. The preferred measurements of the testing department
   2. B. The business objectives and applicable regulations
   3. C. The performance targets of a competing organization
   4. D. The features available in the selected reporting tool

   Answer: B

   Explanation: The official BoK directs engineers to "Design software quality goals and objectives that are consistent with business objectives and regulations." Department preferences, competitor targets, and reporting capabilities do not establish this alignment.

   Reference: 2023 CSQE Body of Knowledge — p. 2, Quality management system, Quality goals and objectives

3. 3A team selects a lifecycle model for medical device software and asks whether FDA's general validation guidance prescribes one particular model. What is the guidance's position?

   1. A. A sequential model is prescribed for every device software project.
   2. B. A lifecycle model should be selected without prescribing a particular model.
   3. C. An iterative model is prescribed when software contains external components.
   4. D. A prototype-based model is prescribed when software has a user interface.

   Answer: B

   Explanation: Section 4.4 states, "This guidance does not recommend any particular life cycle models – only that they should be selected and used for a software development project." The approach must fit the project; device category or interface presence does not mandate the proposed models.

   Reference: General Principles of Software Validation; Final Guidance for Industry and FDA Staff — Section 4.4, p. 11

4. 4A project manager needs a product-oriented hierarchy of the software, services, and data to be delivered, so scope, cost, and schedule can be organized consistently. Which planning structure provides this?

   1. A. Organization breakdown structure
   2. B. Work breakdown structure
   3. C. Risk breakdown structure
   4. D. Responsibility assignment matrix

   Answer: B

   Explanation: NASA describes a WBS as a "hierarchical division of the hardware, software, services, and data required to produce the program/ project’s end product(s)". It decomposes the project around delivered products. An organization structure decomposes organizational units, a risk structure decomposes risks, and a responsibility matrix assigns duties rather than forming this product hierarchy.

   Reference: NASA Systems Engineering Handbook — Appendix B, p. 196, Work Breakdown Structure

5. 5An IV&V review finds 40 defects in 20 thousand lines of software code. What is the defect density in defects per KLOC?

   1. A. 0.5 defects/KLOC
   2. B. 0.002 defects/KLOC
   3. C. 800 defects/KLOC
   4. D. 2 defects/KLOC

   Answer: D

   Explanation: NASA gives "Defect Density = Total Number of Defects Detected / Total KLOC". Thus 40 / 20 = 2 defects/KLOC. Reversing the ratio gives 0.5, using LOC without converting units gives 0.002, and multiplying gives 800.

   Reference: NASA Software Engineering Handbook: Software Independent Verification and Validation — Section 7.3.2(b), Defect Density

6. 6A quality engineer distinguishes evidence that phase outputs meet specified input requirements from evidence that the finished device meets user needs and intended uses. What is the second type of evaluation?

   1. A. Software validation
   2. B. Software testing
   3. C. Software inspection
   4. D. Software verification

   Answer: A

   Explanation: FDA describes validation as confirmation that "software specifications conform to user needs and intended uses". Verification checks specified requirements; testing and inspection are evaluation techniques rather than the name of the user-needs-and-intended-use determination.

   Reference: General Principles of Software Validation; Final Guidance for Industry and FDA Staff — Section 3.1.2, p. 6

7. 7A software organization needs a document that guides, monitors, and measures its overall configuration management process and communicates that process to contractors. Which document provides this infrastructure?

   1. A. Software test report
   2. B. Interface requirements document
   3. C. Configuration management plan
   4. D. Software design specification

   Answer: C

   Explanation: NASA says the CM plan is used "to guide, monitor, and measure the overall CM process." It also communicates CM processes to contractors. Test reports and product specifications do not define this management infrastructure.

   Reference: NASA Systems Engineering Handbook — Section 6.5.1.2.1, p. 146, Internal use

8. 8Procurement and engineering use different terms for the same secure development activities, causing supplier misunderstandings. Which benefit of a shared software quality framework directly addresses this communication problem?

   1. A. A consistent basis for estimating development work effort
   2. B. A common language for communicating development practices
   3. C. A repeatable method for tracing development work products
   4. D. A reusable set of automated checks for development outputs

   Answer: B

   Explanation: NIST explains, "This document provides a common language to describe fundamental secure software development practices." A shared vocabulary directly resolves the terminology gap. Estimation, traceability, and automated checking are real process capabilities, but none establishes agreement on the meanings of terms.

   Reference: Secure Software Development Framework (SSDF) Version 1.1 — Section 1, p. 2

9. 9A security quality dashboard reports many activity counts but management cannot tell whether software security risk is being managed effectively. What should drive selection of the dashboard criteria?

   1. A. How closely the counts follow the project staffing curve
   2. B. How consistently the counts match supplier report formats
   3. C. How effectively the measures indicate management of security risk
   4. D. How readily the measures can be extracted from existing logs

   Answer: C

   Explanation: SSDF PO.4.1 advises, "Ensure that the criteria adequately indicate how effectively security risk is being managed." Ease of collection and reporting consistency are useful considerations but cannot substitute for decision-relevant risk measures.

   Reference: Secure Software Development Framework (SSDF) Version 1.1 — Table 1, PO.4.1, Example 1

10. 10During an agile iteration, a team learns from inspection that its current approach is producing unacceptable results. Which response follows Scrum's empirical process model?

    1. A. Retain the approach until all originally forecast work is completed.
    2. B. Retain the approach until the next project lifecycle is initiated.
    3. C. Adapt the approach when the new information is learned.
    4. D. Adapt the approach after the final product acceptance review.

    Answer: C

    Explanation: The Scrum Guide states, "A Scrum Team is expected to adapt the moment it learns anything new through inspection." Delaying the adjustment to a fixed later boundary prolongs deviation rather than using the feedback.

    Reference: The Scrum Guide — Scrum Theory, Adaptation, p. 4