ISTQB Foundation (CTFL v4.0) Mock Exam #12 — Questions & Answers
Every question in this mock exam, with the correct answer marked and a written rationale behind each option below — for reading and review, not a timed run.
A regression suite has run unchanged for a year and now finds almost no new defects. Which principle explains this, and what should the team do?
Pesticide paradox - review and revise/renew the tests
Repeated identical tests lose effectiveness over time.
Defect clustering - stop testing those modules
Clustering is about where defects concentrate, not test ageing.
Exhaustive testing - run even more of the same tests
Running the same tests more does not help; renew them.
Testing proves the software is now defect-free
Testing can never prove the absence of defects.
The pesticide paradox: unchanged tests stop finding new defects, so tests must be reviewed and updated.
Which pair correctly distinguishes verification from validation?
Verification checks the product meets its specification; validation checks it meets user needs
Standard CTFL distinction.
Verification checks user needs; validation checks the specification
Reversed definitions.
Both mean exactly the same activity
They are distinct concepts.
Verification is only done in production
Verification happens throughout development.
Verification = building the product right (meets specifications); validation = building the right product (meets user needs).
Which TWO of the following are test work products?
Test cases
A core test work product.
Test logs
Records of test execution, a test work product.
The compiler
A development tool, not a test work product.
The production server
Infrastructure, not a test work product.
Test cases and test logs are testware; a compiler and the production server are not.
Why might a genuine defect in the code never cause a failure during operation?
The defective code is never executed under the conditions that would trigger it
No execution of the faulty path means no failure is observed.
Defects always cause a failure every time the program runs
Many defects are latent and condition-dependent.
A defect and a failure are the same thing
A defect is in the code; a failure is observed behaviour.
Because testing removed the defect automatically
Testing detects, it does not auto-remove defects.
If the defective code is never executed (or only under conditions that never occur), it produces no failure.
Quality management is commonly described as comprising which two sub-areas?
Quality assurance (QA) and quality control (QC)
QA is process-oriented; QC (including testing) is product-oriented.
Marketing and sales
Not part of quality management.
Coding and deployment
These are development activities, not QM sub-areas.
Debugging and refactoring
Development activities, not quality management sub-areas.
Quality management comprises quality assurance (QA) and quality control (QC).
Which testing principle states that finding and fixing defects sooner reduces overall cost?
Early testing saves time and money
Defects removed early avoid costly downstream rework.
Defect clustering
That is about defects concentrating in few areas.
Tests show presence, not absence of defects
A true principle, but about what testing can prove.
Testing is context dependent
About adapting the approach, not cost timing.
Early testing saves time and money is one of the seven principles.
Which TWO statements about levels of test independence are correct?
Tests designed by the author of the work product have a low level of independence
Self-testing is the least independent level.
An independent test team is one recognised form of test independence
A dedicated team is a higher level of independence.
Higher independence guarantees finding all defects
No level of independence guarantees that.
Independence is irrelevant to defect detection
Independence can improve effectiveness.
Author-run tests have low independence; an independent team is one higher form; independence is a spectrum and no level guarantees finding all defects.
The way the test process is carried out is influenced by the context of the project. Which TWO of the following are contextual factors that shape how testing is performed? (Choose two.)
The software development lifecycle being used and the tools that are available to the team
Correct — the SDLC and the available tools are explicitly named contextual factors; for example an iterative lifecycle with a CI pipeline leads to a very different test process than a sequential one.
Project constraints such as available time and budget, together with the skills of the team members
Correct — project constraints and team skills are contextual factors: they determine how much can be tested, with which techniques and at which level of formality.
How many of the seven testing principles the team decides to apply in this project
The seven principles are general guidelines that hold in any context; they are not selected item by item and are therefore not a contextual factor of the test process.
The requirement that every test process must reach 100% coverage of all possible inputs
This is not a factor but a misconception: exhaustive testing is impossible except in trivial cases, so no context imposes such a requirement.
Contextual factors include stakeholders, team skills, business domain, technical factors, project constraints (time, budget), organisational factors, the software development lifecycle in use and the available tools.
What does the 'shift left' approach mean in the context of testing?
Performing testing and quality activities earlier in the lifecycle
Earlier involvement finds defects sooner and cheaper.
Delaying all testing until after release
That is the opposite of shift left.
Moving testers to a different physical office
It is about timing in the lifecycle, not location.
Testing only the left half of the user interface
Nothing to do with UI layout.
Shift left means performing testing (and quality) activities earlier in the lifecycle.
System testing primarily evaluates what?
The behaviour of the whole, integrated system against its requirements
System testing covers end-to-end system behaviour.
A single module in isolation
That is component testing.
Only the interfaces between two components
That is integration testing.
Whether end users accept the system for use
That is acceptance testing.
System testing evaluates the behaviour of the whole integrated system against its requirements.
Verifying that a funds transfer debits and credits the correct amounts and computes the right balance is primarily which test type?
Functional testing
It checks what the system does against functional requirements.
Performance testing
That measures speed/throughput, not correctness of amounts.
Usability testing
That evaluates ease of use, not calculation correctness.
Portability testing
That concerns running across environments.
Checking correctness of computed results is functional testing.
What is the purpose of regression testing?
To detect unintended side effects introduced by a change
Regression checks previously working areas still work after a change.
To verify that a specific defect fix worked
That is confirmation testing.
To measure system performance under load
That is performance testing.
To accept the system on behalf of users
That is acceptance testing.
Regression testing detects unintended side effects introduced by changes.
Which TWO of the following are test LEVELS?
System testing
A recognised test level.
Component testing
A recognised test level.
Load testing
A non-functional test type, not a level.
Confirmation testing
Change-related testing, not a level.
System testing and component testing are levels; load testing is a type and confirmation testing is change-related.
Which is the most typical test basis for acceptance testing?
User and business requirements, use cases and business processes
Acceptance testing validates fitness for business use.
The low-level component design and source code
That is the basis for component testing.
The interface specifications between modules
That is the basis for integration testing.
The CI pipeline configuration files
Not a typical acceptance test basis.
Acceptance testing is typically based on user/business requirements, use cases and business processes.
Which review type is the LEAST formal, often just a quick peer check with no documented process or defined roles?
Informal review
The least formal review type.
Inspection
The most formal review type, with metrics and roles.
Technical review
A documented, fairly formal review by peers.
Audit
A formal, independent evaluation against standards.
An informal review has no documented process or defined roles.
Why are reviews especially cost-effective in a project?
They find defects early in work products before code is executed
Early detection avoids expensive late rework.
They run automatically without any human effort
Reviews require human participation.
They guarantee the product will have no defects
No activity guarantees zero defects.
They replace all dynamic testing
Reviews complement dynamic testing.
Reviews find defects early, before code is written/executed, reducing downstream cost.
Which TWO are recognised roles in a formal review?
Author
The owner of the work product under review.
Moderator (facilitator)
Leads and facilitates the review.
The compiler
A tool, not a review role.
The end customer
Not a defined role in the review process.
Author and moderator/facilitator are review roles; a compiler and the end customer are not.
Among the roles defined for the review process, who decides what is to be reviewed, allocates the necessary time and budget for it, and makes sure the review fits into the overall project schedule?
The manager
Correct — deciding what to review and providing time, budget and resources for it is the manager's responsibility in the review process.
The moderator (facilitator)
The moderator makes sure the review meeting runs effectively and mediates between participants, but does not decide the review scope or allocate budget.
The author
The author creates the work product under review and corrects the accepted anomalies afterwards. The author does not control the project schedule or budget.
The scribe
The scribe collates the anomalies found during individual review and records the decisions and new issues raised in the review meeting.
The manager decides what has to be reviewed, allocates time in the schedule and provides the budget and resources. The moderator only makes the review meeting itself run effectively.
A parcel service sets the shipping tier by integer weight in kg: 1-5 small, 6-20 medium, 21-50 large. Using equivalence partitioning on VALID weights only, what is the minimum number of test cases to cover each valid tier exactly once?
3
One representative value per valid tier.
2
Three valid tiers cannot be covered by two cases.
4
Only three valid tiers exist here.
6
That counts boundaries, not partitions.
Three valid tiers (small, medium, large) need three representative test cases.
A field accepts integers from 1 to 30 inclusive; values outside are rejected. Using the 2-value boundary value analysis approach (boundary plus nearest neighbour), which set tests BOTH boundaries?
{0, 1, 30, 31}
Boundary plus nearest outside neighbour at each end.
{1, 30}
Boundaries alone omit the neighbours.
{0, 1, 2, 29, 30, 31}
That is the 3-value approach.
{1, 2, 29, 30}
Uses inside neighbours instead of outside ones.
Each boundary (1, 30) plus its nearest outside neighbour (0, 31): {0,1,30,31}.
For the same field accepting integers 1 to 30 inclusive, how many distinct values does the 3-value boundary value analysis approach require to cover BOTH boundaries?
6
Three values per boundary, two boundaries, no overlap.
4
That is the 2-value approach.
8
Over-counts; three per boundary suffice.
3
Three values cover only one boundary.
Lower {0,1,2} and upper {29,30,31} = six distinct values.
Use the decision table below. A loyalty member who checked in online arrives with a 25 kg bag (over the 23 kg limit). Which rule applies and what fee results?
Rule R3 - Overweight fee
Online Y, Bag<=23 N, Member Y is exactly column R3.
Rule R1 - No fee
R1 requires Bag <= 23 = Y.
Rule R4 - Overweight + standard
R4 requires Member = N.
Rule R7 - Overweight + standard
R7 requires Checked in online = N.
Online = Y, Bag <= 23 = N, Member = Y matches R3: Overweight fee.
In the decision table below, rules R5 and R6 both yield 'Standard fee' when Checked in online = N and Bag <= 23 = Y, regardless of membership. Using don't-care simplification, how many columns merge into a single combined rule?
2 (R5 and R6 merge into one rule)
Both give Standard fee with membership as don't-care.
4
Only these two columns share an identical action under that condition pair.
8
Only two columns collapse here, not all eight.
1
One column cannot 'merge'; two merge into one.
R5 and R6 share the same action and differ only in a don't-care condition, so 2 merge into 1.
A specification has multiple input conditions whose combinations lead to several different system actions. Which test design technique systematically covers these combinations?
Decision table testing
Designed for combinations of conditions producing different actions.
Boundary value analysis
Targets edges of a single ordered range.
Statement testing
A white-box technique based on code.
Exploratory testing
Unscripted and experience-based, not systematic combination coverage.
Decision table testing systematically covers combinations of conditions and resulting actions.
Using the support-ticket state machine below, which event sequence is a VALID path from New to Closed?
New -> triage -> Open -> assign -> InProgress -> resolve -> Resolved -> close -> Closed
Every transition exists in this order.
New -> assign -> InProgress -> close
There is no New->assign transition; triage to Open comes first.
New -> triage -> Open -> resolve -> Closed
Open cannot go directly to Resolved; it must be assigned first.
New -> triage -> Open -> assign -> InProgress -> close -> Closed
Closing requires the Resolved state first (resolve, then close).
The valid path is triage, assign, resolve, close.
Consider this routine with six executable statements: (1) INPUT a; (2) INPUT b; (3) sum = a + b; (4) IF sum > 100; (5) PRINT high; (6) PRINT sum. Statement 5 runs only when the IF is true. A single test runs with a = 10, b = 20. What statement coverage does it achieve?
83% (5 of 6 statements)
Statements 1, 2, 3, 4 and 6 execute; statement 5 is skipped: 5/6 ≈ 83%.
100%
Statement 5 (PRINT high) is not reached when sum = 30.
67%
Five of six statements run, not four.
50%
Only one statement is skipped, five execute.
sum = 30, so the IF is false; 5 of 6 statements run = 83%.
Which TWO of the following are black-box (specification-based) test techniques?
Boundary value analysis
Derived from the specification (input ranges).
Decision table testing
Based on specified condition combinations.
Statement testing
A white-box technique based on code.
Branch testing
A white-box technique based on code decisions.
Boundary value analysis and decision table testing are black-box; statement and branch testing are white-box.
A tester uses a standard list of common web-form problems (required fields, max length, invalid characters, etc.) to guide testing. Which technique is this?
Checklist-based testing
Guided by a predefined checklist of items to verify.
Exploratory testing
Unscripted and learning-driven, not a fixed checklist.
Boundary value analysis
A systematic technique on input ranges.
State transition testing
Based on states and events.
Using a predefined checklist to guide testing is checklist-based testing.
Which of the following are experience-based test techniques? (Choose TWO.)
Exploratory testing.
Correct: relies on the tester's experience.
Error guessing.
Correct: based on anticipating likely mistakes.
Boundary value analysis.
Wrong: that is a black-box (specification-based) technique.
Statement testing.
Wrong: that is a white-box (structure-based) technique.
Exploratory testing and error guessing are experience-based techniques.
What is the purpose of entry criteria for a test activity?
They define the preconditions that must be met before the activity can sensibly begin
Entry criteria prevent starting work prematurely.
They define when the activity can be declared finished
That describes exit criteria.
They list the exact defects to be found
Defects cannot be known in advance.
They set the testers' salaries
Unrelated to entry criteria.
Entry criteria define the preconditions that must be met before an activity can start effectively.
An incorrect tax calculation in released software is an example of which kind of risk?
Product risk
It concerns the quality of the delivered product itself.
Project risk
Project risks affect management/delivery, not the product's quality directly.
Residual risk
Residual risk is what remains after mitigation.
Risk level
Risk level is a measure, not a category.
A defect in the delivered product's quality is a product risk.
After testing the high-risk areas of a product, the risk that still remains is called what?
Residual risk
Risk that remains after risk-reduction activities.
Product risk
That is the category of risk, not what remains.
Project risk
A category about project delivery, not the remainder.
Risk likelihood
That is one factor of a risk, not the remainder.
The risk remaining after mitigation/testing is the residual risk.
Which TWO are essential fields of a well-written defect report?
A unique identifier and current status
Enables tracking the defect through its lifecycle.
Steps to reproduce with expected and actual results
Lets developers reproduce and diagnose the defect.
The tester's lunch order
Irrelevant to a defect report.
A marketing slogan for the release
Irrelevant to a defect report.
A unique ID/status and steps to reproduce with expected/actual results are essential; the others are irrelevant.
What is a primary purpose of test monitoring?
To provide visibility of progress by comparing actual status against the plan
Monitoring informs control decisions.
To write the source code of the system
Monitoring is not a development activity.
To guarantee the product is defect-free
No activity guarantees that.
To replace the need for any test planning
Monitoring complements planning.
Test monitoring gives visibility and compares actual progress against the plan.
Using three-point estimation with optimistic = 4 days, most likely = 8 days, pessimistic = 18 days, what is the expected duration via (a + 4m + b) / 6?
9 days
(4 + 4*8 + 18)/6 = 54/6 = 9.
8 days
8 is the most likely value, not the weighted estimate.
10 days
Does not match the formula result of 9.
11 days
Arithmetic slip; the correct value is 9.
(4 + 32 + 18) / 6 = 54 / 6 = 9 days.
Which TWO of the following are recognised test approaches/strategies?
Risk-based testing
Allocates effort according to product risk.
Reactive (e.g. exploratory) testing
Responds to the system as it is encountered.
Alphabetical testing
Not a recognised test approach.
Salary-based testing
Not a recognised test approach.
Risk-based and reactive (e.g. exploratory) testing are recognised approaches; the other two are not real strategies.
Which of the following is a recognised test estimation technique?
Metrics-based estimation using historical project data
A standard, defensible estimation approach.
Picking the date management already announced
That is not estimation; it ignores actual effort.
Doubling whatever the developers say at random
Arbitrary, not a recognised technique.
Using the number of open meeting invites
Irrelevant to effort estimation.
Metrics-based (using historical data) and expert-based estimation are recognised techniques.
Why is it useful to manage defects through a defined lifecycle with states such as 'open', 'in progress', 'fixed' and 'closed'?
It provides visibility of each defect's status and supports reporting and control.
Correct — defined states make defect status trackable and reportable.
It guarantees that no new defects will be introduced.
A lifecycle tracks defects but cannot prevent new ones from appearing.
It removes the need to write reproduction steps.
Reproduction steps are still needed regardless of the lifecycle.
It automatically fixes defects when they change state.
State changes record status; they do not fix the code.
A defect lifecycle gives visibility and control: it shows the current status of each defect, supports prioritisation, and enables reporting and trend analysis.
Which tool type primarily helps create and manage the data needed to run tests?
Test data preparation tool
Builds and manages the data sets used during execution.
Performance testing tool
Generates load and measures performance.
Static analysis tool
Analyses code without executing it.
Review (collaboration) tool
Supports the review process, not test data.
A test data preparation tool creates and manages test data.
Which TWO are genuine benefits of test automation?
More efficient repeated execution of tests
Machines run repetitive tests faster than humans.
Greater consistency and reuse of test assets
Automated tests run the same way every time.
Automated tests never need maintenance
Automation requires ongoing maintenance as the system changes.
Automation eliminates the need for test analysis
Tests still have to be analysed and designed.
More efficient repeated execution and greater consistency/reuse are real benefits; automation still needs maintenance and test analysis.