ISTQB Foundation (CTFL v4.0) Mock Exam #5 — Questions & Answers
Every question in this mock exam, with the correct answer marked and a written rationale behind each option below — for reading and review, not a timed run.
Which of the following BEST defines a defect (bug, fault)?
A flaw in a component or system that can cause it to fail to perform its required function.
Correct — the definition of a defect.
An observable incorrect behaviour during execution.
That describes a failure.
A human action that produces an incorrect result.
That describes an error (mistake).
A condition that must be met before testing starts.
That describes an entry criterion.
A defect is a flaw in a component or system that can cause it to fail to perform its required function.
Which of the following BEST explains the principle 'defects cluster together'?
A small number of modules usually contains most of the defects.
Correct — this is defect clustering.
Defects are evenly distributed across all modules.
This contradicts defect clustering.
Repeated tests stop finding new defects.
That is the pesticide paradox.
Testing depends on the context.
A valid principle, but not clustering.
A small number of modules usually contains most of the defects; testing should focus effort there (Pareto principle).
Which of the following BEST describes the relationship between testing and quality assurance (QA)?
QA is process-oriented; testing is a product-oriented quality-control activity contributing to QA.
Correct — testing supports QA but is not the same.
Testing and QA are exactly the same thing.
They are related but distinct.
QA is performed only after testing is complete.
QA is ongoing process work.
Testing replaces the need for QA.
Testing is one input to QA, not a replacement.
QA is process-oriented; testing is a product-oriented quality-control activity that contributes to QA.
A test case specifies preconditions, inputs, expected results and postconditions. The 'expected result' is an example of which of the following?
The predicted output derived from the test basis, used to judge pass/fail.
Correct — expected results come from an oracle/test basis.
The behaviour actually observed when the test runs.
That is the actual result.
The hardware needed to run the test.
That is part of the test environment.
The defect report raised after the test.
A defect report is an output when results differ.
The expected result is the predicted output derived from the test basis (oracle), used to judge pass/fail.
Which statement about the principle 'testing is context dependent' is CORRECT?
Safety-critical software is tested differently and more rigorously than a simple website.
Correct — context determines how testing is done.
All software should be tested in exactly the same way.
This contradicts context dependence.
Context only affects the choice of programming language.
Context affects the whole approach.
Context dependence means testing can be skipped for small projects.
Context shapes testing; it does not justify skipping it.
Testing is done differently in different contexts: e.g. safety-critical software is tested more rigorously than a simple website.
Which test process activity produces test cases, test data requirements and test environment requirements by transforming test conditions?
Test design
Correct — design turns test conditions into concrete test cases.
Test analysis
Analysis identifies test conditions.
Test execution
Execution runs the already-designed tests.
Test monitoring
Monitoring tracks progress; it does not create test cases.
Test design transforms test conditions into test cases and other test ware, specifying how to test.
Which TWO of the following are essential generic skills for a good tester? (Choose two.)
Analytical and critical thinking with attention to detail.
Correct — core tester skills.
Good communication skills, including constructive defect reporting.
Correct — communication is essential.
The ability to write all of the production code.
Not a generic tester skill.
Authority to approve the project budget.
A management responsibility, not a tester skill.
Good testers need analytical/critical thinking and good communication. Writing production code and approving budgets are not generic tester skills.
Which of the following is a typical objective of test completion (closure) activities?
Archiving test ware and capturing lessons learned for future projects.
Correct — a key completion activity.
Designing the first test cases for the project.
That is test design, performed much earlier.
Writing the system requirements.
Not a testing activity.
Setting up the test environment for the first time.
That belongs to test implementation.
Test completion includes archiving test ware and identifying lessons learned for process improvement.
In an iterative-incremental (Agile) lifecycle, why does regression testing become especially important?
Frequent changes risk breaking previously working features each iteration.
Correct — incremental change drives the need for regression.
Because no new features are ever added after the first iteration.
Features are added continuously.
Because regression testing replaces all other test levels.
Regression complements other levels.
Because iterative lifecycles never use automation.
They rely heavily on automation for regression.
Functionality grows incrementally and code changes frequently, creating a high risk of breaking previously working features.
Acceptance testing of a COTS product by potential or existing customers in their own environment is BEST described as which form of acceptance testing?
Beta (field) testing
Correct — performed by customers at their own sites.
Alpha testing
Alpha testing is at the developer's site.
Contractual acceptance testing
That checks against contract terms.
Operational acceptance testing
Focuses on operational aspects like backup/restore.
Beta (field) testing is performed by potential or existing customers at their own locations; alpha testing is at the developer's site.
What is the MAIN focus of component integration testing as opposed to component testing?
The interfaces and interactions between integrated components.
Correct — integration testing targets the interfaces.
The internal logic of a single isolated component.
That is the focus of component testing.
The end-to-end business processes of the whole system.
That aligns with system or acceptance testing.
Whether the system meets users' business needs.
That is validation in acceptance testing.
Component integration testing focuses on interactions and interfaces between integrated components, whereas component testing checks each component in isolation.
A bank must add a new tax rule to comply with a change in legislation, with no other functional change. Which maintenance trigger does this represent?
A modification driven by a change in regulations.
Correct — regulatory change is a recognised maintenance trigger.
Corrective maintenance to fix a reported failure.
No failure is being fixed.
Migration to a new platform.
The platform is not changing.
Retirement of the application.
The application is being updated, not retired.
A modification to keep the software compliant with new/changed regulations is a maintenance trigger driven by changes in the rules/environment.
Which of the following is the BEST example of a non-functional quality characteristic being tested?
Checking that unauthorised users cannot access protected data.
Correct — security is a non-functional characteristic.
Verifying that a shopping cart total is calculated correctly.
A functional test of a calculation.
Checking that a search returns the correct results.
Functional testing of search behaviour.
Confirming that a fix resolved a reported defect.
That is confirmation testing.
Security is a non-functional characteristic; checking that unauthorised users cannot access protected data is a non-functional (security) test.
An operational system has to be modified and the team must decide how much maintenance testing, including regression testing, is required. Which TWO factors mainly determine the extent of that testing? (Choose two.)
The risk associated with the change, for example whether it touches business-critical functionality or interfaces to other systems.
Correct — risk is a primary driver: the higher the risk of the changed and affected areas, the more maintenance and regression testing is justified.
The size of the existing system and the size of the change itself, as established by impact analysis.
Correct — a small change in a large, highly coupled system can affect many areas; impact analysis shows which parts and which existing tests are affected.
Whether the change was requested by the customer or proposed by the development team.
The origin of the change request does not alter its technical risk or the areas it affects. Two identical changes need the same testing regardless of who asked for them.
The number of testers who were available during the original development project.
Historical staffing is not a factor in the scope of maintenance testing. What matters is the current impact of the change, which is determined by impact analysis and risk.
The extent of maintenance testing depends on the risk of the change, the size of the existing system and the size of the change; impact analysis is used to identify the affected areas and the consequences for the existing testware.
Which of the following BEST describes a benefit of involving stakeholders in reviews early in the lifecycle?
It builds shared understanding and detects misunderstandings early.
Correct — a key benefit of early reviews.
It removes the need for any dynamic testing later.
Dynamic testing is still required.
It guarantees the requirements will never change.
Reviews do not freeze requirements.
It transfers all responsibility for quality to the reviewers.
Responsibility for quality remains shared.
Early reviews create shared understanding, detect misunderstandings and defects early, and reduce later rework and risk.
Which role in a formal review ensures the review process runs effectively, mediates between participants, and schedules the meeting?
The facilitator (moderator)
Correct — the facilitator runs the review and mediates.
The author
The author owns the work product, not the facilitation.
The reviewer
Reviewers identify defects; they do not run the process.
The scribe
The scribe records findings.
The facilitator (moderator) ensures the review runs effectively, mediates and often organises it.
An organisation must verify that a safety-critical software design strictly conforms to an industry standard, with metrics collected and a formal documented process. Which review type is MOST appropriate?
Inspection
Correct — the most formal review, with metrics and a defined process.
Informal review
Too lightweight for safety-critical conformance.
Walkthrough
Author-led and less formal; lacks the required rigour.
Ad hoc review
An ad hoc review has no defined process or metrics.
An inspection, the most formal review type, follows a rigorous documented process with roles, rules, checklists and metrics.
Which of the following is the BEST example of a defect that static analysis tools can detect automatically?
A variable that is used before it has been assigned a value.
Correct — a classic static analysis finding.
A slow response time when 500 users log in at once.
Performance under load requires execution.
A wrong total displayed after a complex user workflow.
Observing wrong output requires running the system.
A crash that only happens with a specific external service down.
A runtime/environment failure requiring dynamic testing.
Static analysis tools can automatically detect issues like a variable used before being initialised, without executing the code.
For the order-lifecycle state machine below, how many test cases are required for 0-switch coverage (every valid single transition exactly once)?
6
Created->Paid, Paid->Packed, Packed->Shipped, Shipped->Delivered, Created->Cancelled, Paid->Cancelled.
4
Misses the two cancel transitions.
5
Undercounts by one transition.
7
Over-counts; there are exactly six transitions.
There are six transitions: pay, pack, ship, deliver, cancel (from Created), cancel (from Paid).
An online shop applies shipping and discount rules per the decision table below. A customer is NOT a member, has an order total of $120 (so 'Order >= $100' is true), and enters a valid promo code. Which rule applies and what actions result?
Rule R5: Free shipping and 10% discount.
Correct — F, T, T maps to R5 with both actions.
Rule R1: Free shipping and 10% discount.
R1 requires Member = T; this customer is not a member.
Rule R7: 10% discount only.
R7 requires Order >= $100 = F; here the order is $120.
Rule R8: no action.
R8 requires all conditions false; two are true here.
Member = F, Order >= $100 = T, Valid promo code = T corresponds to rule R5, whose actions are Free shipping AND 10% discount.
For the control flow graph below there are two decisions (at node 2 and node 4). What is the minimum number of test cases needed to achieve 100% branch (decision) coverage?
3
Correct — three paths cover all four branch outcomes.
2
Two paths cannot cover node 2 false plus both outcomes of node 4.
4
Branch coverage needs only 3 here.
1
One path cannot cover all four branch outcomes.
Four branch outcomes must be covered. The 2-false path (1-2-6-7) covers node 2 false. Reaching node 4 needs node 2 true; one path takes 4 true (1-2-3-4-5-7) and another 4 false (1-2-3-4-6-7). So 3 test cases, and it cannot be done in two.
An ATM withdrawal accepts an amount that must be a multiple of 10, from a minimum of 20 up to a maximum of 500 inclusive. Using boundary value analysis on the valid range limits (20 and 500 as boundaries), which pair represents the two valid boundary values?
20 and 500
Correct — the minimum and maximum valid boundary values.
10 and 510
These are just outside the range — invalid neighbours.
0 and 1000
Far outside the valid range.
250 and 260
Mid-range values, not boundaries.
The valid range boundaries are the minimum 20 and maximum 500; BVA tests these boundary values themselves.
A login screen locks the account after 3 consecutive failed attempts. States: Active (0 fails), 1Fail, 2Fail, Locked. A correct password from any non-locked state returns to Active; a wrong password increments the fail count; the 3rd wrong attempt moves to Locked. Counting valid transitions for 0-switch coverage, how many test cases are required?
5
Correct — five valid transitions, one test case each.
3
Three counts only the failing transitions, missing the two returns.
4
Misses one of the five valid transitions.
6
There are only 5 valid transitions for 0-switch.
Valid transitions: Active→1Fail, 1Fail→2Fail, 2Fail→Locked, plus correct-password returns from 1Fail and from 2Fail = 5 transitions, so 5 test cases.
What does an 'invalid transition' test case in state transition testing typically check?
That the system correctly handles an event that is not valid in the current state.
Correct — invalid transitions test robust handling of unexpected events.
That every valid transition is taken at least once.
That is 0-switch coverage.
That the code achieves 100% statement coverage.
A white-box criterion, unrelated.
That boundary values are tested at each state.
Boundary value analysis is a separate technique.
Negative state transition testing checks that the system correctly handles events that are not valid in the current state.
Why might a tester choose collaborative test design (e.g. the three amigos: business, development, testing) when writing acceptance criteria for a user story?
To build shared understanding and produce clear, testable acceptance criteria.
Correct — collaboration reduces ambiguity and improves testability.
To let the tester write the production code.
Collaboration is about shared understanding, not coding.
To avoid having to test the story at all.
Collaboration improves testing; it does not remove it.
To guarantee the story contains no defects.
No technique can guarantee the absence of defects.
Collaborative approaches build shared understanding, catch ambiguities early and produce clearer, testable acceptance criteria.
A tester uses knowledge of where defects have occurred in similar systems to design tests targeting likely error-prone areas (e.g. division by zero, empty inputs). Which technique is being used?
Error guessing
Correct — an experience-based technique anticipating likely defects.
Equivalence partitioning
A systematic black-box technique, not guessing.
Statement testing
A white-box technique based on code structure.
Decision table testing
A systematic technique for combinations of conditions.
Error guessing is an experience-based technique where the tester anticipates likely defects and designs tests to expose them.
A grading scale maps an integer mark (0–100) to letters: A = 90–100, B = 80–89, C = 70–79, F = 0–69. Using two-value boundary value analysis, how many distinct boundary values must be tested across the whole input range (including the overall minimum 0 and maximum 100)?
8
Correct — 0, 69, 70, 79, 80, 89, 90, 100.
6
Misses the overall minimum 0 and maximum 100.
4
Counts only one side of each internal boundary.
12
Overcounts; there are 8 distinct values.
Internal boundaries 69/70, 79/80, 89/90 plus overall min 0 and max 100 give: 0, 69, 70, 79, 80, 89, 90, 100 = 8 distinct values.
Which TWO statements about equivalence partitioning and boundary value analysis are CORRECT? (Choose two.)
Boundary value analysis is an extension of equivalence partitioning focused on partition edges.
Correct — BVA refines EP by testing the boundaries.
Both are black-box (specification-based) techniques.
Correct — neither requires knowledge of the code structure.
Boundary value analysis applies to unordered sets such as colours.
BVA needs ordered partitions with boundaries.
Equivalence partitioning is a white-box technique.
EP is a black-box technique.
BVA is an extension of equivalence partitioning focusing on partition edges; both are black-box techniques.
What is the PRIMARY purpose of coverage measurement when using white-box test techniques?
To objectively measure how thoroughly the code structure has been exercised.
Correct — coverage indicates structural thoroughness and gaps.
To prove the software is free of defects.
100% coverage does not prove the absence of defects.
To measure how fast the system responds.
That is performance testing.
To replace the need for black-box techniques.
White-box coverage complements black-box techniques.
Coverage measurement objectively measures the thoroughness of testing relative to the code structure, identifying untested parts.
R2 (risk level 16)
4 × 4 = 16 is the highest computed risk level, so R2 is addressed first.
R1 (risk level 10)
2 × 5 = 10, lower than R2's 16.
R3 (risk level 10)
5 × 2 = 10, also below R2's 16.
R4 (risk level 9)
3 × 3 = 9 is the lowest, so it is not the first priority.
Risk levels: R1=10, R2=16, R3=10, R4=9. R2 has the highest product (16) and is prioritised first.
Which of the following is the BEST description of a test approach (test strategy) within a test plan?
How testing will be carried out: levels, types, techniques and risk handling.
Correct — the approach defines how testing is performed.
The full source code of the system under test.
Source code is not part of a test approach.
A list of every individual defect found.
That is defect data, not the test approach.
The marketing plan for the product.
Unrelated to testing.
The test approach describes how testing will be carried out: levels and types, techniques, entry/exit criteria, and how risks will be addressed.
A test manager estimates testing using the three-point technique (a + 4m + b) / 6. Module X: a=2, m=5, b=14. What is the expected estimate for Module X?
6 days
Correct — 36 / 6 = 6.
7 days
That is the simple average (2+5+14)/3 = 7.
5 days
5 is the most likely value, not the estimate.
8 days
Does not match the formula result of 6.
(2 + 4×5 + 14) / 6 = (2 + 20 + 14) / 6 = 36 / 6 = 6 days.
Which estimation technique bases the test effort estimate on the judgement and experience of the people who will do the work or of experts?
Expert-based estimation (e.g. Wideband Delphi, three-point).
Correct — it relies on expert/team judgement.
Statement coverage
A white-box coverage criterion, not estimation.
Boundary value analysis
A test design technique, not estimation.
Exploratory testing
An experience-based test technique, not estimation.
Expert-based techniques rely on the experience of those doing the work or of experts; e.g. Wideband Delphi and three-point estimation.
A defect was found in production. Root cause analysis traces it to an ambiguous requirement that was never reviewed. What is the BEST process improvement action?
Introduce or strengthen requirement reviews to catch ambiguities early.
Correct — addresses the root cause.
Blame the developer who implemented the requirement.
Blame does not improve the process.
Stop releasing to production to avoid all defects.
Not a realistic improvement action.
Add more test cases for unrelated modules.
Does not address the requirement-review root cause.
Introducing or strengthening requirement reviews addresses the root cause and prevents recurrence.
Which of the following is a typical content item of a defect report, used to indicate the degree to which the defect affects the system?
Severity
Correct — severity reflects the impact on the system.
The total number of testers on the project.
Not relevant to an individual defect's impact.
The marketing budget.
Unrelated to a defect report.
The programming language version.
An environment detail that does not indicate impact degree.
Severity indicates the degree of impact the defect has on the system, independent of how urgently it needs fixing (priority).
A burndown chart and the number of test cases passed/failed per day are examples of information typically presented in which test management artefact?
A test progress report (or dashboard).
Correct — ongoing status appears in progress reports.
The system requirements specification.
Requirements are an input to testing.
An individual test case specification.
That describes a single test.
The user manual.
A product document, not a test management artefact.
Test progress reports (and dashboards) present ongoing information such as execution status, pass/fail counts and burndown.
When performing product risk analysis, which pair of factors is used to assess the risk level of each identified risk?
Likelihood and impact.
Correct — these two factors define the risk level.
Cost and colour.
Colour is irrelevant to risk assessment.
Team size and office location.
These do not define a product risk's level.
Number of test cases and lines of code.
These are size metrics.
Each risk's level is assessed from its likelihood and its impact.
Which of the following is the BEST reason for prioritising the order in which test cases are executed?
So the most important/risky tests run first and find key defects early.
Correct — prioritisation maximises value if time runs out.
To ensure all tests take exactly the same time.
Not about equalising execution time.
To avoid having to design test cases.
Prioritisation orders already-designed tests.
To make the test report look longer.
Not a valid reason.
Prioritising execution ensures the most valuable tests run first, so important defects are found early even if execution is cut short.
Which of the following BEST describes a limitation to be aware of when relying on automated test results?
Automated tests only verify what they were programmed to check and may miss other defects.
Correct — they can create false confidence outside their scope.
They always find every defect in the system.
No approach finds every defect.
They never require any maintenance.
Automated tests require ongoing maintenance.
They can fully replace human judgement in all cases.
Human judgement remains essential, e.g. for exploratory testing.
Automated tests only check what they were programmed to check; over-reliance can leave important behaviours untested.
Which category of test tool would BEST support generating large volumes of realistic input data for testing?
A test data preparation tool.
Correct — it generates/manipulates test data.
A static analysis tool.
It analyses code, not generate data.
A test management tool.
It manages the process, not generate bulk data.
A coverage measurement tool.
It measures coverage, not generate data.
Test data preparation tools generate or manipulate large volumes of realistic test data.