We study quantum soft covering and privacy amplification against quantum side information. The former task aims to approximate a quantum state by sampling from a prior distribution and querying a quantum channel. The latter task aims to extract uniform and independent randomness against quantum adversaries. For both tasks, we use trace distance to measure the closeness between the processed state and the ideal target state. We show that the minimal amount of samples for achieving an $\varepsilon$-covering is given by the $(1-\varepsilon)$-hypothesis testing information (with additional logarithmic additive terms), while the maximal extractable randomness for an $\varepsilon$-secret extractor is characterized by the conditional $(1-\varepsilon)$-hypothesis testing entropy. When performing independent and identical repetitions of the tasks, our one-shot characterizations lead to tight asymptotic expansions of the above-mentioned operational quantities. We establish their second-order rates given by the quantum mutual information variance and the quantum conditional information variance, respectively. Moreover, our results extend to the moderate deviation regime, which are the optimal asymptotic rates when the trace distances vanish at sub-exponential speed. Our proof technique is direct analysis of trace distance without smoothing.