CSQE ASQ Certified Software Quality Engineer Exam Free Practice Exam Questions (2026 Updated)

A software configuration baseline is a formally approved set of one or more configuration items that serves as a fixed reference point for future development, testing, release, or maintenance. Once a baseline is established, changes to the baselined items must be controlled through configuration management and change control procedures. Testing may occur before or after a baseline, but testing alone does not define a baseline. Installing a configuration library provides storage and control capability, not the baseline itself. Packaging items for shipment may describe a release package, but not every baseline is a shipment. The defining characteristic of a baseline is formal approval and control of configuration items, making option C correct.

================

The first step in managing earned value metrics is determining the critical resources to be tracked. This is essential because earned value management (EVM) relies on accurate data regarding resources to measure project performance and progress. Identifying which resources (such as labor, materials, and equipment) are critical ensures that the EVM metrics (planned value, earned value, and actual cost) are based on reliable and relevant data, which in turn supports better decision-making and project control.

The daily scrum meeting (or daily stand-up) is a time-boxed event in agile methodologies designed for the team to synchronize activities and discuss any impediments.

Three Questions: During the daily scrum, team members typically address three questions: What did I do yesterday? What will I do today? Are there any impediments in my way?

Focus on Impediments: Discussing impediments is crucial as it allows the team to identify and address obstacles that may hinder progress, facilitating prompt resolution.

Short-Term Planning: The daily scrum focuses on the immediate tasks and issues, not on long-term planning or changes to the product roadmap.

Beginning some low-level design before all high-level design is complete can be appropriate when dependencies are clearly understood and controlled. Software projects often overlap activities to reduce schedule duration, but doing so safely requires impact analysis and dependency management. Low-level design should only begin in areas where the related high-level architecture, interfaces, constraints, and design decisions are sufficiently stable. If unfinished high-level design could affect the low-level area, early work may cause rework, inconsistency, or design defects. It is not always necessary to finish all high-level design first, and it is not required that the same people perform both activities. The key condition is that unfinished high-level work must not affect the low-level design area.

================

In a data flow diagram, a data store represents a place where data is held for later use. It may be shown as an open-ended rectangle or parallel-line symbol, depending on the notation used. A data store can represent a file, table, database, repository, queue, or other storage location. Processes read data from it or write data to it through labeled data flows. A timing delay is not normally represented by the standard data-store symbol. An I/O interrupt is a control or hardware event rather than a data repository. A sub-process of P1 would normally be modeled as another process or through decomposition. Since X is represented as the storage element in the diagram, the correct answer is B.

================

The efficiency rate of error detection for a phase measures how effectively that phase detects defects that originated in the same phase before they escape to later phases. N represents defects both originated and found in phase X. S represents defects that originated in phase X but escaped and were found in later phases. Therefore, the total number of defects originating in phase X is N + S. The detection efficiency for phase X is the portion found within the phase, which is N divided by N + S. Option A reverses the relationship and can produce a value greater than one. Option C is not a rate. Option D is not a valid defect containment formula. The correct formula is N / (N + S).

================

Outsourcing is a business practice where a company hires an external organization to perform tasks, handle operations, or provide services. One key advantage of outsourcing is that it allows the primary company to focus its resources on its core competencies. By delegating non-core activities to external specialists, the company can concentrate on what it does best, thereby enhancing efficiency, innovation, and competitive advantage in its primary market.

The chart compares the number of defects in two projects across defect types, so the valid conclusion is about the pattern or distribution of defects. A defect profile shows how defects are distributed by category, such as type, source, severity, component, or cause. The chart supports the conclusion that the two projects have different defect profiles because the defect counts differ across the defect-type categories. It does not prove that the projects have the same defect rates, because a defect rate requires a denominator such as size, effort, time, or function points. It also does not provide phase-by-phase defect-removal data. Therefore, no conclusion can be drawn about which project removed more defects per phase. The correct answer is B.

================

Cyclomatic complexity is a metric used to determine the number of linearly independent paths through a program ' s source code.

Definition: Cyclomatic complexity provides a quantitative measure of the complexity of a program, which is directly related to the number of test cases needed to achieve full branch coverage.

Calculation: It is calculated using the control flow graph of the program, where nodes represent blocks of code and edges represent control flow paths.

Test Cases: The metric indicates the minimum number of test cases required to cover all possible paths, ensuring that each statement is executed at least once.

A functional requirement describes what the software must do, including behavior, processing rules, inputs, outputs, calculations, validations, and responses to events. The statement “The system must reject non-numeric input” defines a specific behavior the system must perform when invalid input is entered, so it is a functional requirement. The 99.9% operational requirement describes availability, which is a non-functional quality attribute. The response time requirement describes performance, another non-functional requirement. The requirement to develop according to IEEE standards describes a process, compliance, or constraint requirement rather than system behavior. Software quality engineers distinguish these requirement types because they affect design, verification, validation, traceability, and test planning differently.

================

A management practice that will provide business continuity involves creating and documenting a business continuity plan. This includes:

Risk Assessment : Identifying potential risks and their impact on business operations.

Strategy Development : Developing strategies to mitigate identified risks and ensure continuity of critical business functions.

Documentation : Documenting the continuity plan, including detailed procedures and guidelines for response and recovery.

Training and Testing : Training employees on the plan and regularly testing the plan to ensure its effectiveness.

A well-documented business continuity plan ensures that an organization can maintain or quickly resume its critical functions during and after a disruption.

A test plan should be changed after changes to the design specifications. This ensures that the tests remain relevant and accurately reflect the new design and functionality of the software. Keeping the test plan updated with design changes helps ensure comprehensive test coverage and alignment with the project ' s requirements.

Program review meetings are used to monitor the overall health and progress of a project or program. Regular review topics commonly include schedule status, cost performance, scope, risks, issues, milestones, resources, dependencies, and major constraints. Project dependencies are especially important because delays or failures in one dependent task, supplier, component, team, or external interface can affect the entire program. Change request approvals are usually handled by a change control board. Quality system updates are typically handled through quality management reviews or process improvement forums. Problem reports may be reviewed when they affect project status, but they are not the primary regular program-level item among the choices. Therefore, project dependencies are the best answer.

================

A " Scrum of Scrums " meeting is structured most like a program review meeting. It is designed to coordinate efforts among multiple Scrum teams working on the same project. During this meeting, representatives from each team discuss their progress, impediments, and dependencies with other teams. This is akin to a program review meeting where higher-level coordination and integration of efforts are reviewed and managed.

Limiting access to a software system through passwords supports the security objective of access control. Access control ensures that only authorized users can enter the system or perform specific actions based on identity, role, privilege, or permission. Passwords are one authentication mechanism used to verify identity before access is granted. An audit trail records user actions and system events, but passwords do not by themselves supply complete audit records. Preserving data integrity means protecting data from unauthorized or improper modification, which access control may support indirectly. Backup and recovery protect availability and restoration after failure or loss. Since the question specifically describes restricting system entry through passwords, the security objective being met is maintaining access control.

================

A software requirements specification (SRS) for software that is part of multiple systems should include external interfaces. This ensures that the software can interact correctly with other sys tems and components, defining how the software will communicate with other systems, devices, or external data sources.

When establishing a defect tracking system, one important goal is to define how defects will be classified. Classification rules make defect data consistent, searchable, reportable, and useful for analysis. Defects may be categorized by severity, priority, origin phase, detection phase, root cause, component, status, type, and customer impact. Without clear classification, defect reports become inconsistent and metrics lose value. Collecting as much data as possible can overload users and reduce reporting quality. Approving a validation plan is a test management activity, not the main purpose of a defect tracking system. Determining how to prevent defects is important later during causal analysis, but the tracking system must first define reliable defect categories and workflow rules.

================

Senior management is responsible for establishing the company ' s quality policies. They set the strategic direction and ensure that quality objectives align with the overall business goals. Senior management ' s commitment to quality is crucial as it drives the organization ' s culture, resources allocation, and priorities, ensuring that quality practices are integrated into the development processes.

Function point analysis is a standardized method used to measure the size and complexity of software based on its functionality. It uses counts of specific elements like external inquiries, which refer to the user-initiated requests for information from the system. These are one of the five major components (the others being external inputs, external outputs, internal logical files, and external interface files) considered in function point analysis.