ISTQB Foundation (CTFL v4.0) Mock Exam #14 — Questions & Answers
Every question in this mock exam, with the correct answer marked and a written rationale behind each option below — for reading and review, not a timed run.
Why is testing necessary in a software development project?
It reduces the risk of failures occurring in operation
Correct — a core reason for testing is lowering the level of residual risk before release.
It proves the software contains no defects
Wrong — testing cannot prove the absence of defects (a testing principle).
It replaces the need for requirements reviews
Wrong — dynamic testing complements, but does not replace, static reviews.
It guarantees the software will satisfy every user
Wrong — no amount of testing can guarantee universal satisfaction.
Testing reduces the risk of failures occurring in operation; it cannot guarantee a defect-free product.
Which of the following are objectives of testing? (Choose TWO.)
Finding defects and failures
Correct — evaluating work products to detect defects is a primary objective.
Building confidence in the level of quality
Correct — providing information to build confidence is a stated objective.
Fixing the defects that are found
Wrong — correcting defects is debugging/development, not testing.
Proving that no defects remain
Wrong — impossible; testing cannot prove the absence of defects.
Testing evaluates quality and finds defects, and builds confidence in the quality level. Fixing defects is debugging; proving no defects exist is impossible.
A test team runs the same automated regression suite every night. Over time it finds fewer and fewer new defects. Which testing principle explains this?
The pesticide paradox
Correct — reusing identical tests stops revealing new defects; vary and update them.
Defect clustering
Wrong — clustering is about defects concentrating in a few modules, not test decay.
Testing is context dependent
Wrong — this principle is about adapting testing to context, not diminishing returns.
Absence-of-defects fallacy
Wrong — that fallacy concerns quality vs. user needs, not repeated tests.
The pesticide paradox: repeating the same tests eventually stops finding new defects; tests must be reviewed and revised.
A developer mistypes a formula. The program later produces a wrong total on screen. In ISTQB terms, what is the wrong total on screen?
A failure
Correct — an observable deviation of the component from its expected result is a failure.
An error
Wrong — the error is the human mistake (mistyping), not the visible result.
A defect
Wrong — the defect is the faulty formula in the code, not the on-screen result.
A root cause
Wrong — the root cause is the underlying reason for the error, deeper than the mistake itself.
Error (mistake) → defect (fault in code) → failure (observable wrong behaviour). The wrong output is a failure.
Which statement correctly distinguishes testing from debugging?
Testing can show failures; debugging finds, analyses and removes their causes
Correct — this is the standard ISTQB distinction.
Testing and debugging are two names for the same activity
Wrong — they are distinct activities with different goals.
Debugging is only performed by testers
Wrong — debugging is typically performed by developers.
Testing removes defects; debugging only reports them
Wrong — this reverses the roles; testing does not remove defects.
Testing can trigger failures caused by defects; debugging is the development activity that finds, analyses and fixes those defects.
A product has very few defects but users reject it because it does not meet their real needs. Which testing principle does this illustrate?
The absence-of-defects fallacy
Correct — a low defect count does not guarantee a system that meets user needs.
Early testing saves time and money
Wrong — this principle is about shifting testing left, not about user needs.
Tests show the presence of defects
Wrong — this principle is about what testing can and cannot prove, not user fit.
Exhaustive testing is impossible
Wrong — this principle concerns the infeasibility of testing everything.
The absence-of-defects fallacy: finding and fixing defects does not help if the system is unusable or does not meet user needs.
During which test activity are the test conditions and test coverage items derived from the test basis?
Test analysis
Correct — test analysis derives test conditions and coverage items from the test basis.
Test design
Wrong — test design turns test conditions into concrete test cases.
Test implementation
Wrong — test implementation prepares testware and procedures for execution.
Test completion
Wrong — test completion archives testware and reports on results at the end.
Test analysis identifies testable features and defines test conditions/coverage items from the test basis ("what to test"). Test design defines test cases ("how to test").
A team keeps its test cases, automated scripts and test data in the same version control system as the code they exercise. What is the main benefit of placing testware under configuration management in this way?
Changes to the testware are traceable, and each version can be reproduced and related to the version of the test object it belongs to.
Correct — this is precisely why testware must be under configuration management: identifiable, versioned and consistent with the test object.
It guarantees that the tests will reveal all remaining defects in the test object.
No practice can guarantee that. Testing can show the presence of defects but never prove their absence, whatever tooling is used.
It removes the need to maintain the testware when the test object changes.
Configuration management records and controls changes; it does not perform them. Testware still has to be updated whenever the test object evolves.
It makes the test object independent of the test environment it runs in.
Versioning the testware says nothing about environment dependencies. Environment differences remain a well-known cause of failures that appear only in production.
Configuration management of testware makes changes traceable and allows any version of the testware to be reproduced and related to the version of the test object it was built for, which is essential for regression and maintenance testing.
In a sequential (V-model) lifecycle, when should test planning and test design for the system test level ideally begin?
As soon as the system requirements are available
Correct — early involvement lets testers design tests against the requirements and find defects early.
After all code has been written
Wrong — waiting until coding is finished delays defect detection and raises cost.
Only after component testing has passed
Wrong — planning can begin far earlier, in parallel with the corresponding development phase.
During the acceptance test phase
Wrong — that is far too late for the system test level.
Shift-left: test activities for a level should begin as soon as the corresponding basis (e.g., system requirements) is available, not after coding.
Which test level primarily verifies the interfaces and interactions between integrated components or systems?
Integration testing
Correct — it targets interfaces and interactions between integrated items.
Component testing
Wrong — component testing verifies individual components in isolation.
Acceptance testing
Wrong — acceptance testing establishes readiness for use against user needs.
System testing
Wrong — system testing evaluates the behaviour of the whole system.
Integration testing focuses on interfaces and interactions between components (component integration) or systems (system integration).
Which of the following are examples of non-functional testing? (Choose TWO.)
Measuring response time under peak load
Correct — performance efficiency is a non-functional quality characteristic.
Assessing how easily new users complete a task
Correct — usability is a non-functional quality characteristic.
Checking that a discount is calculated correctly
Wrong — verifying a calculation against a rule is functional testing.
Verifying a login accepts valid credentials
Wrong — checking expected functional behaviour is functional testing.
Non-functional testing evaluates how well the system behaves — performance, usability, reliability, security, etc. Verifying a calculation result or a business rule is functional testing.
After a defect in the payment module is fixed, the team re-runs the exact tests that previously failed to confirm the fix works. What is this called?
Confirmation testing (re-testing)
Correct — it confirms the original defect has been successfully fixed.
Regression testing
Wrong — regression testing looks for unintended side effects elsewhere, not the fixed defect itself.
Smoke testing
Wrong — smoke testing is a broad shallow check that a build is stable enough to test.
Maintenance testing
Wrong — maintenance testing is a broader activity triggered by changes to a system in operation.
Re-running the previously failing tests to confirm a fix is confirmation (re-)testing. Regression testing checks that the change did not break other, unchanged areas.
What best characterises the 'shift-left' approach to testing?
Performing test activities earlier in the lifecycle
Correct — shift-left brings testing forward to detect defects as early as possible.
Delaying all testing until just before release
Wrong — that is the opposite of shift-left.
Testing only in production with real users
Wrong — that describes testing in production, not shifting left.
Assigning testing entirely to the operations team
Wrong — shift-left is about timing, not reassigning ownership to operations.
Shift-left means performing testing activities earlier in the lifecycle (e.g., reviewing requirements, writing tests before code) to find defects sooner.
A bank changes its core system so it can run on a new operating system version, with no change to its features. Which type of maintenance triggers this testing?
Adaptive maintenance
Correct — adapting the system to a new environment without changing features is adaptive maintenance.
Corrective maintenance
Wrong — corrective maintenance fixes defects found in operation.
Perfective maintenance
Wrong — perfective maintenance improves or adds features/performance.
Emergency maintenance
Wrong — emergency maintenance is an urgent corrective fix, not an environment adaptation.
Adapting a system to a changed or new environment (e.g., new OS) is adaptive maintenance; the resulting testing is maintenance testing.
Why can static testing (e.g., reviewing a requirements document) be more cost-effective than dynamic testing for certain defects?
It finds defects in work products early, before they propagate into code
Correct — early defect detection avoids costly rework later.
It executes the code faster than dynamic testing
Wrong — static testing does not execute the code at all.
It guarantees the removal of all defects
Wrong — no technique guarantees removal of all defects.
It replaces the need for any dynamic testing
Wrong — static and dynamic testing are complementary, not substitutes.
Static testing finds defects directly in work products before code exists, so defects are removed early and cheaply, and it can find defects (e.g., ambiguities) that dynamic testing cannot easily reveal.
Which activities are performed during the review process as defined in the syllabus? (Choose TWO.)
Individual review (individual preparation)
Correct — reviewers examine the work product individually and note findings.
Communication and analysis of findings
Correct — findings are discussed and their status/ownership decided.
Executing the test cases
Wrong — executing tests is dynamic testing, not part of a review.
Debugging the source code
Wrong — debugging is a development activity, not a review activity.
The review process includes planning, initiate review, individual review, communication & analysis, and fixing & reporting. Executing test cases and debugging are not part of a review.
A team needs a formal, documented review led by a trained moderator, with defined roles, entry/exit criteria and metrics collected. Which review type fits best?
Inspection
Correct — the most formal review, with a trained moderator, roles, criteria and metrics.
Informal review
Wrong — an informal review has no defined process, roles or documented output.
Walkthrough
Wrong — a walkthrough is led by the author and is less formal, without required metrics.
Technical review
Wrong — a technical review is formal but focuses on technical decisions and is typically peer-led, not necessarily with a trained moderator and full metrics.
An inspection is the most formal review type: led by a trained facilitator/moderator, uses defined roles, entry/exit criteria and metrics.
In the review process, one activity is dedicated to discussing the anomalies that the reviewers reported, giving each of them a status and a severity, and deciding who has to act on them. Which activity is this?
Issue communication and analysis
Correct — this is the activity in which anomalies are discussed, classified by status and severity, and assigned to someone for action.
Individual review
During individual review each reviewer examines the work product alone and records possible anomalies. They are not yet discussed, classified or assigned.
Review initiation
In review initiation the work product and related material are distributed to the participants and their questions about the assignment are answered, before anyone starts reviewing.
Fixing and reporting
In fixing and reporting the author corrects the accepted anomalies and the outcome of the review, including whether the exit criteria are met, is reported.
Issue communication and analysis is the activity in which the reported anomalies are discussed, their status and severity are decided, ownership is assigned and the quality characteristics of the work product are evaluated.
A tester with deep domain knowledge anticipates where defects are likely (e.g., empty fields, special characters, large values) and designs tests around those guesses. Which technique is being used?
Error guessing.
Correct — designing tests from anticipated likely defects is error guessing.
Equivalence partitioning.
EP is a systematic black-box technique based on input partitions, not intuition.
Decision table testing.
Decision tables address combinations of conditions, not guessed defects.
Statement testing.
Statement testing is a white-box coverage technique.
Error guessing uses the tester's experience and knowledge of likely mistakes to design tests; it can be supported by defect/fault lists.
A field 'age' accepts whole numbers from 18 to 65 inclusive. Prices differ for three groups: 18–25, 26–59, 60–65. Using equivalence partitioning, what is the MINIMUM number of test cases needed to cover all valid and invalid partitions exactly once?
5
Correct — 3 valid partitions + 2 invalid partitions = 5 test cases.
3
Wrong — this counts only the valid partitions and ignores the two invalid ones.
4
Wrong — misses one partition; there are 3 valid and 2 invalid.
6
Wrong — overcounts; only 5 distinct partitions exist here.
Valid partitions: 18–25, 26–59, 60–65 (3). Invalid partitions: below 18 and above 65 (2). Total 5 partitions → 5 test cases, one per partition.
A discount applies only when the order total is between 100 and 500 inclusive. Using the 2-value boundary value analysis approach, which set of values tests the boundaries of the valid range?
99, 100, 500, 501
Correct — each boundary (100, 500) plus its immediate neighbour outside the range.
100, 300, 500
Wrong — 300 is a mid-partition value; this misses the neighbours just outside the range.
99, 101, 499, 501
Wrong — uses inner neighbours instead of the boundaries 100 and 500 themselves.
0, 100, 500, 1000
Wrong — 0 and 1000 are far from the boundaries, not the nearest neighbours.
2-value BVA tests each boundary and its nearest neighbour on the other side. For [100,500]: 99, 100, 500, 501.
For the same valid range 100 to 500 inclusive, how many distinct values does the 3-value boundary value analysis approach require to cover BOTH boundaries?
6
Correct — 3 values per boundary × 2 boundaries = 6 distinct values.
4
Wrong — 4 is the 2-value approach result, not the 3-value one.
3
Wrong — 3 covers only one boundary; both boundaries are required.
8
Wrong — overcounts; only 6 distinct values are needed.
3-value BVA tests, for each boundary, the boundary and both neighbours. Lower: 99,100,101; Upper: 499,500,501 → 6 distinct values.
Which statements about equivalence partitioning are correct? (Choose TWO.)
One representative value per partition is normally sufficient
Correct — all members of a partition are assumed to be handled the same way.
Both valid and invalid partitions should be identified
Correct — EP covers valid and invalid input partitions.
Partitions may overlap to increase coverage
Wrong — partitions must be disjoint (non-overlapping).
Every value in a partition must be tested individually
Wrong — that defeats the purpose of partitioning; one representative suffices.
In EP, values in one valid/invalid partition are assumed to be processed the same way, so one representative per partition is used. Partitions must not overlap, and both valid and invalid partitions should be identified.
Use the parking-garage fee decision table below. A club MEMBER parks on a WEEKDAY (not a weekend) and stays for 4 hours. Which rule applies and what fee is charged?
R6 → $15
Correct — Member=Y, Weekend=N, Stay>3h=Y is exactly column R6, fee $15.
R2 → $20
Wrong — R2 is a non-member (Member=N) weekday long stay; here the driver is a member.
R5 → $7.50
Wrong — R5 is a member weekday SHORT stay (Stay>3h=N); this stay is 4 hours.
R8 → $12
Wrong — R8 is a member on a WEEKEND; this is a weekday.
Member=Y, Weekend=N, Stay>3h=Y matches R6, giving a fee of $15.
The parking-garage decision table has three Boolean conditions (Member?, Weekend?, Stay > 3 hours?) and every combination produces a distinct fee. How many test cases are required to achieve full decision-table coverage (each rule/column exercised once)?
8
Correct — 2^3 = 8 rules, and none can be collapsed because each has a unique action.
4
Wrong — 4 would assume half the columns collapse, but all 8 actions differ.
6
Wrong — there is no basis for 6; the full set is 8 distinct rules.
3
Wrong — 3 is the number of conditions, not the number of rules/test cases.
With 3 independent Boolean conditions there are 2^3 = 8 combinations. Because every combination yields a distinct action, no columns can be collapsed, so 8 test cases are needed.
The media-player state machine below starts in the Stopped state. Which of the following event sequences is a VALID path (every event triggers a defined transition)?
play, pause, play, stop
Correct — Stopped→Playing→Paused→Playing→Stopped; all four transitions exist.
pause, play, stop
Wrong — 'pause' is not defined from the initial Stopped state.
play, stop, pause
Wrong — after stop the player is Stopped, where 'pause' has no transition.
stop, play, pause
Wrong — 'stop' is not defined from the initial Stopped state.
From Stopped: play→Playing, pause→Paused, play→Playing, stop→Stopped. Every event has a defined transition, so this sequence is valid.
For the same media-player state machine, how many test cases are needed to achieve 0-switch coverage (all valid single transitions / all valid transitions covered once)?
5
Correct — there are 5 valid transitions; 0-switch coverage exercises each once.
3
Wrong — 3 is the number of states, not the number of transitions.
6
Wrong — there are only 5 defined transitions in the diagram.
9
Wrong — 9 corresponds to all state×event pairs (including invalid ones), not 0-switch coverage.
0-switch coverage requires exercising every valid transition once. The transitions are: Stopped→Playing (play), Playing→Paused (pause), Playing→Stopped (stop), Paused→Playing (play), Paused→Stopped (stop) = 5 transitions.
A senior tester uses their knowledge of where defects have appeared in similar systems to design tests for likely error-prone areas, without a formal model. Which test technique is being used?
Error guessing
Correct — an experience-based technique relying on anticipated likely defects.
Boundary value analysis
Wrong — BVA is a systematic black-box technique based on input boundaries.
Statement testing
Wrong — statement testing is a white-box technique based on code structure.
Decision table testing
Wrong — decision table testing is a systematic black-box technique using a formal model.
Using experience and intuition about likely defects, without a systematic model, is error guessing — an experience-based technique.
In a collaboration-based test approach such as Acceptance Test-Driven Development (ATDD), when are the acceptance tests typically created?
Collaboratively, before development of the corresponding functionality begins
Correct: in ATDD, business, development and test collaborate to define acceptance tests up front from user stories.
Only after the feature is fully implemented and released
Incorrect: that contradicts the 'driven' nature of ATDD, where tests come first.
By the operations team during production monitoring
Incorrect: acceptance tests are defined by the cross-functional team, not operations in production.
Automatically generated by the build pipeline without human input
Incorrect: ATDD is a collaborative human practice, not auto-generation.
In risk-based testing, how is the level of a product risk typically determined?
By combining the likelihood of the risk with its impact
Correct — risk level = likelihood × impact.
By counting the number of requirements
Wrong — the count of requirements does not define risk level.
By the size of the test team
Wrong — team size is unrelated to product risk level.
By the number of test cases already written
Wrong — the number of tests is an output, not a determinant of risk.
Risk level is a function of the likelihood (probability) of the problem occurring and its impact (harm) if it does.
Which of the following is an example of an EXIT criterion (definition of done) for a test level?
The planned coverage has been achieved and no high-priority defects remain open
Correct — this is a typical exit criterion for stopping testing.
The test environment is installed and available
Wrong — an available environment is an entry criterion, allowing testing to start.
The test data has been prepared
Wrong — prepared test data is an entry criterion for starting execution.
The testers have been assigned to the project
Wrong — resource assignment is a precondition (entry), not an exit criterion.
Exit criteria define when testing can stop, e.g., required coverage reached and no open high-priority defects. Availability of a test environment is an entry criterion.
Which of the following pieces of information should a good defect report contain? (Choose TWO.)
Steps to reproduce the failure
Correct — reproduction steps let developers investigate and confirm the defect.
Expected and actual results
Correct — the deviation between expected and actual is essential to describe the defect.
The tester's monthly salary
Wrong — irrelevant to diagnosing or fixing a defect.
The product's marketing plan
Wrong — not part of a defect report.
A defect report should include an identifier/summary, steps to reproduce, expected vs actual results, severity/priority, etc. The tester's salary and the marketing plan are irrelevant.
Using three-point estimation, a task is estimated as optimistic = 4 days, most likely = 10 days, pessimistic = 22 days. What is the estimate using the formula (a + 4m + b) / 6?
11 days
Correct — 66 / 6 = 11 days.
12 days
Wrong — this is the simple average (4+10+22)/3 = 12, not the weighted PERT value.
10 days
Wrong — 10 is the most likely value, not the weighted estimate.
13 days
Wrong — does not match the formula; the correct result is 11 days.
(4 + 4×10 + 22) / 6 = (4 + 40 + 22) / 6 = 66 / 6 = 11 days.
What is the main purpose of test monitoring?
To gather information about test progress and compare it against the plan
Correct — monitoring provides visibility for control decisions.
To fix the defects found during testing
Wrong — fixing defects is debugging, not monitoring.
To design the test cases
Wrong — designing tests is a test design activity, not monitoring.
To write the test policy for the organization
Wrong — the test policy is a higher-level organizational document, not a monitoring output.
Test monitoring gathers information on test progress and compares actual progress against the plan, so that control actions can be taken.
Which of the following is a product risk rather than a project risk?
The software may calculate interest incorrectly
Correct — a defect in the delivered product is a product risk.
A key tester may leave before the project ends
Wrong — staff availability is a project risk.
The test environment may be delivered late
Wrong — schedule/logistics of the environment is a project risk.
The budget for testing may be cut
Wrong — budget/resource issues are project risks.
A product risk relates to a possible deficiency in the product itself (e.g., calculation errors). A project risk relates to management/schedule/resources (e.g., late delivery, staff shortage).
Test control involves taking corrective actions when monitoring shows a deviation from the plan. Which of the following are examples of test control actions? (Choose TWO.)
Re-prioritising tests when a risk changes
Correct — reprioritisation is a corrective control action.
Adjusting the test schedule when a dependency is delayed
Correct — re-planning the schedule in response to a deviation is a control action.
Writing the original system requirements
Wrong — that is a requirements activity, not test control.
Coding a new product feature
Wrong — development of features is not a test control action.
Control actions include re-prioritising tests when risk changes and adjusting the test schedule. Writing the original requirements or coding a feature are not test control actions.
What are potential benefits of independent testing (testing performed by people who are not the authors of the code)? (Choose TWO.)
Independent testers often see different and additional defects
Correct — a fresh perspective reveals failures the author might overlook.
They are less influenced by the author's assumptions
Correct — independence reduces confirmation bias about the code being correct.
It removes the need for any developer testing
Wrong — developer (component) testing remains valuable and necessary.
It guarantees that all defects will be found
Wrong — no approach can guarantee finding all defects.
Independent testers tend to recognise different kinds of failures and are less subject to author bias/assumptions. Independence does not remove the need for developer testing, nor guarantee finding all defects.
Which of the following is the BEST example of an appropriate risk-mitigation action that testing can take in response to an identified product risk?
Designing additional, more rigorous tests focused on the high-risk feature.
Correct — targeted testing mitigates the identified risk.
Hiring more developers for the next project.
A general staffing action, not testing risk-mitigation.
Ignoring the risk because the deadline is tight.
Ignoring risk is not mitigation.
Reducing testing of the high-risk feature to save time.
This increases, rather than mitigates, the risk.
Testing mitigates product risk by designing and running targeted tests, reviewing related work products, and applying more rigorous techniques where risk is high.
A team runs a large suite of stable, repetitive regression tests on every build. Which is a key benefit of automating these tests?
Reduced repetitive manual effort and faster, consistent feedback
Correct — automation efficiently repeats stable tests and reports consistently.
It guarantees the software has no defects
Wrong — automation runs tests; it cannot guarantee a defect-free product.
It removes the need for any test design
Wrong — tests still must be designed; automation only executes them.
It is always cheaper than manual testing in the short term
Wrong — automation has significant up-front setup and maintenance costs.
Automation excels at repetitive, stable tests: it reduces repetitive manual effort and provides fast, consistent feedback on every build.
Which of the following are genuine RISKS or challenges when introducing a test automation tool? (Choose TWO.)
Underestimating the effort to maintain the automated tests
Correct — maintenance of automated tests is a well-known, often underestimated cost.
Having unrealistic expectations of what the tool can achieve
Correct — over-reliance and unrealistic expectations are recognised tool risks.
The tool automatically defines the test strategy
Wrong — a tool does not define strategy; that remains a human responsibility.
Buying a tool always improves product quality by itself
Wrong — quality comes from good testing practices, not merely owning a tool.
Real risks include underestimating the effort to introduce and maintain the tool, and over-relying on the tool (unrealistic expectations). A tool does not eliminate the need for a test strategy, and adopting a tool does not automatically improve product quality by itself.