CAD Professional Ethics & Standards 2 — Questions and Answers
Question 1: A developer discovers that a deployed application is processing user data in a way not disclosed in the privacy policy. What is the FIRST action they should take?
- Delete the collected data immediately
- Report the issue to the appropriate stakeholder or compliance officer (Correct answer)
- Patch the application silently to avoid alarming users
- Wait until the next scheduled audit
Correct answer: Report the issue to the appropriate stakeholder or compliance officer
Ethical practice requires immediately escalating undisclosed data processing to the compliance officer or relevant stakeholder to initiate proper remediation.
Question 2: Which principle is BEST described by ensuring that application access is granted only to the minimum level needed to perform a job function?
- Separation of duties
- Principle of least privilege (Correct answer)
- Defense in depth
- Non-repudiation
Correct answer: Principle of least privilege
The principle of least privilege limits user and system access rights to only what is necessary for legitimate business purposes.
Question 3: An application developer is asked by a manager to bypass code review for an urgent production fix. The ethical response is to:
- Comply because the manager has authority
- Perform a self-review and document the exception with justification (Correct answer)
- Refuse to deploy until a full review is completed next sprint
- Deploy and not document the bypass
Correct answer: Perform a self-review and document the exception with justification
When process exceptions are unavoidable, ethical practice requires documenting the deviation and its business justification to maintain accountability.
Question 4: Under the ACM Code of Ethics, a software professional's FIRST obligation is to:
- Their employer's business interests
- The public good (Correct answer)
- The advancement of the software profession
- Their client's confidentiality
Correct answer: The public good
The ACM Code of Ethics places the public good and societal benefit as the highest priority obligation for computing professionals.
Question 5: A CAD professional knowingly uses a third-party library with an unresolved critical security CVE to meet a deadline. This behavior PRIMARILY violates which ethical standard?
- Confidentiality
- Competence and due care (Correct answer)
- Impartiality
- Intellectual property rights
Correct answer: Competence and due care
Using components with known critical vulnerabilities without remediation violates the duty of competence and due care owed to users and stakeholders.
Question 6: When a developer identifies a conflict of interest in a project assignment, the ethical course of action is to:
- Complete the project while keeping the conflict private
- Disclose the conflict to the appropriate authority and recuse if necessary (Correct answer)
- Transfer the conflict to a junior developer
- Ignore it if it does not affect technical decisions
Correct answer: Disclose the conflict to the appropriate authority and recuse if necessary
Transparency requires disclosing conflicts of interest to supervisors or ethics committees so that objectivity and integrity are preserved.
Question 7: A developer is pressured to falsify test results to meet a release milestone. According to professional ethics standards, they should:
- Comply to maintain team harmony
- Refuse and document the pressure applied (Correct answer)
- Falsify only the non-critical test cases
- Ask a colleague to submit the falsified results instead
Correct answer: Refuse and document the pressure applied
Falsifying test results is fraud; the ethical obligation is to refuse, document the coercive situation, and escalate through proper channels.
CAD Professional Ethics & Standards 2
A developer discovers that a deployed application is processing user data in a way not disclosed in the privacy policy.
What is the FIRST action they should take?