ISTQB Foundation (CTFL v4.0) Mock Exam #6 — Questions & Answers
Every question in this mock exam, with the correct answer marked and a written rationale behind each option below — for reading and review, not a timed run.
Which statement best describes the difference between testing and debugging?
Testing can trigger failures caused by defects, while debugging finds, analyses and fixes those defects.
Correct: testing reveals failures, debugging removes the defects.
Testing and debugging are two names for the same activity.
Wrong: they are distinct activities with different goals.
Debugging is done before testing to prevent defects.
Wrong: debugging follows a failure, it does not prevent defects.
Testing fixes the defects it finds, while debugging only reports them.
Wrong: this reverses the roles.
Testing can trigger failures; debugging is the development activity that locates and fixes the underlying defects.
According to the seven testing principles, what can dynamic testing show?
It can show that defects are present, but cannot prove that there are none.
Correct statement of the first principle.
It can prove the software is completely free of defects if all tests pass.
Wrong: passing tests never prove absence of defects.
It guarantees the absence of defects in the tested areas.
Wrong: no testing guarantees absence of defects.
It can prove correctness for all inputs through exhaustive testing.
Wrong: exhaustive testing is not feasible (principle 2).
Principle 1: testing shows the presence of defects, not their absence.
Why is exhaustive testing generally not feasible?
The number of possible input and precondition combinations is too large except for trivial cases.
Correct — this is the exhaustive testing principle.
Test tools cannot execute more than a few hundred test cases.
Wrong: tools can run very many tests; the limit is combinatorial, not tooling.
Exhaustive testing is forbidden by the ISTQB syllabus.
Wrong: it is infeasible, not forbidden.
It would find too many defects to fix.
Wrong: that is not the reason it is infeasible.
Principle 2: except for trivial cases, the number of combinations is too large to test all of them.
A developer misunderstands a requirement and writes incorrect code. During execution the system crashes. Which sequence correctly maps these events to ISTQB terms?
Error (mistake) → defect (in the code) → failure (the crash).
Correct causal chain per ISTQB.
Failure → defect → error.
Wrong: this reverses the chain.
Defect → error → failure.
Wrong: the human error comes first, not the defect.
Error → failure → defect.
Wrong: the defect exists before the failure occurs.
A human error (mistake) introduces a defect in the code, which when executed causes a failure.
Which of the following are valid objectives of testing? (Choose TWO.)
Preventing defects by reviewing requirements and design early.
Correct: early static evaluation prevents defects.
Building confidence in the level of quality of the test object.
Correct: a core objective of testing.
Proving that the software contains no defects.
Wrong: impossible (principle 1).
Replacing the need for requirements specifications.
Wrong: testing does not replace requirements.
Testing both prevents defects (early evaluation) and builds confidence; it cannot prove the absence of defects.
A team analyses defects found in production and traces them back to unclear acceptance criteria. This analysis is best described as identifying the:
Root cause of the defects.
Correct: the underlying origin is the root cause.
Failure rate of the system.
Wrong: that is a reliability measure, not origin analysis.
Test coverage level.
Wrong: coverage measures how much was tested.
Exit criterion.
Wrong: exit criteria define when to stop testing.
Tracing defects back to their origin is root cause analysis.
How do testing and quality assurance (QA) relate?
Testing is a form of quality control (product-oriented); QA is process-oriented, ensuring appropriate processes are followed.
Correct distinction between QC and QA.
Testing and QA are identical.
Wrong: QA is broader and process-focused.
QA is a subset of testing performed only by testers.
Wrong: QA covers the whole process, not just testing.
QA replaces testing once a process is mature.
Wrong: good processes do not remove the need for testing.
Testing is product-oriented quality control; QA is process-oriented.
Which activity of the ISTQB test process consists of running the test suites, comparing actual results with expected results, and logging anomalies for the discrepancies that are found?
Test execution
Correct — running the tests, comparing actual with expected results and logging anomalies are exactly the tasks of test execution.
Test implementation
Test implementation prepares everything needed to run the tests — test procedures, test suites, test data and the environment — but nothing is actually run in it.
Test design
Test design transforms test conditions into test cases and identifies test data requirements. It produces the tests but does not run or evaluate them.
Test completion
Test completion happens when execution is over: it collects and archives testware, reports on the test effort and feeds lessons learned into improvements.
Test execution is the activity in which test suites are run according to the test schedule, actual results are compared with expected results and anomalies are logged and analysed to establish their likely cause.
What is the main idea behind a 'shift-left' approach to testing?
Performing testing activities earlier, e.g. reviewing requirements and writing tests before code is complete.
Correct: earlier testing finds defects sooner and cheaper.
Moving all testing to the end of the project.
Wrong: that is the opposite of shift-left.
Shifting testing responsibility entirely to operations.
Wrong: shift-left is about timing, not handing off to ops.
Reducing the amount of testing to save time.
Wrong: it changes timing, not the amount.
Shift-left moves test activities earlier in the SDLC.
Which sequence lists the typical test levels in order?
Component testing, component integration testing, system testing, acceptance testing.
Correct order of the four typical test levels.
System, acceptance, component, integration.
Wrong: order is reversed.
Acceptance, system, integration, component.
Wrong: this runs from high level down, which is not the typical order.
Integration, component, acceptance, system.
Wrong: integration cannot precede component testing.
Component → component integration → system → acceptance.
A test verifies how quickly a web page responds under 500 concurrent users. Which test type is this?
Non-functional testing (performance/efficiency).
Correct: it tests a quality attribute, not a function.
Functional testing.
Wrong: functional testing checks what the system does, not how fast.
White-box (structural) testing.
Wrong: structural testing is based on code structure, not performance.
Confirmation testing.
Wrong: confirmation testing re-checks a fixed defect.
Response time under load is a non-functional (performance) characteristic.
After a defect fix, the tester re-runs the originally failing test to check the fix, then runs other tests to ensure nothing else broke. These two activities are, respectively:
Confirmation testing and regression testing.
Correct mapping of the two activities.
Regression testing and confirmation testing.
Wrong: the order is swapped.
Smoke testing and retesting.
Wrong: these are not the terms for the described activities.
Integration testing and system testing.
Wrong: these are test levels, not the activities described.
Re-running the fixed test = confirmation testing; checking nothing else broke = regression testing.
Which of the following are forms of acceptance testing? (Choose TWO.)
User acceptance testing (UAT).
Correct: a standard form of acceptance testing.
Operational acceptance testing (OAT).
Correct: checks operational readiness (backup, recovery, etc.).
Component integration testing.
Wrong: that is an integration test level.
Branch (decision) testing.
Wrong: that is a white-box test technique.
UAT and operational acceptance testing are recognised forms of acceptance testing.
An organisation migrates its application to a new cloud platform without changing functionality. What kind of testing is primarily triggered?
Maintenance testing (triggered by migration/environment changes), including regression testing.
Correct: migration is a maintenance trigger.
Component testing only.
Wrong: a migration affects the whole system, not just components.
Acceptance testing of brand-new features.
Wrong: no new features were added.
No testing is required because functionality is unchanged.
Wrong: environment changes can still introduce failures.
Environment/migration changes trigger maintenance testing, including regression testing.
Which statement about static testing is correct?
It examines work products without executing the code, e.g. through reviews and static analysis.
Correct definition of static testing.
It requires executing the software with test data.
Wrong: that is dynamic testing.
It can only be applied to source code.
Wrong: it also applies to requirements, designs, etc.
It is a synonym for performance testing.
Wrong: performance testing is dynamic and non-functional.
Static testing examines work products without executing code.
Which review type is the most formal, with a documented procedure, defined roles, metrics and a trained facilitator?
Inspection.
Correct: the most formal review type.
Informal review.
Wrong: informal reviews have no defined process.
Walkthrough.
Wrong: a walkthrough is less formal, often led by the author.
Ad-hoc testing.
Wrong: that is a dynamic technique, not a review.
An inspection is the most formal review type.
Which are benefits of finding defects early through reviews? (Choose TWO.)
Reduced cost of fixing defects compared with finding them later.
Correct: earlier fixes are cheaper.
Defects can be removed before they are coded into the software.
Correct: reviews catch requirement/design defects early.
Reviews guarantee that no dynamic testing is needed afterwards.
Wrong: dynamic testing is still required.
Reviews always find more defects than any dynamic technique.
Wrong: this is an overgeneralisation.
Early review reduces fix cost and removes defects before they are coded.
In a formal review, which role is responsible for the review process, schedules the meeting and ensures it runs effectively?
The facilitator (moderator).
Correct: ensures the review runs effectively.
The author.
Wrong: the author created the work product under review.
The scribe (recorder).
Wrong: the scribe records findings, not manages the process.
The manager who reads the document last.
Wrong: not a defined review role.
The facilitator (moderator) leads and manages the review.
For the same routine (one IF with no ELSE followed by a statement), what is the minimum number of test cases for 100% branch (decision) coverage?
2
One test makes the decision true, the other false.
1
One test covers only one outcome of the decision.
3
Two outcomes need only two cases.
6
Matches statement count, not branch coverage.
One test for IF true and one for IF false = 2.
An online shop charges shipping based on order weight: 0 up to and including 2 kg costs EUR 5; over 2 kg up to and including 10 kg costs EUR 9; over 10 kg costs EUR 15. A weight of 0 kg or negative is invalid (must be greater than 0). Using equivalence partitioning on the weight input, how many VALID equivalence partitions are there?
Three valid partitions (over 0 to 2 kg, over 2 to 10 kg, over 10 kg).
Correct: three priced ranges form three valid partitions.
Four valid partitions.
Wrong: there are only three priced ranges; the fourth (<=0) is invalid.
Two valid partitions.
Wrong: that misses the over-10 kg range.
One valid partition because weight is a single field.
Wrong: a single field can still have multiple partitions.
Valid ranges: (0,2], (2,10], (10,inf) = three valid partitions; the invalid partition (weight <= 0) is separate.
For the same shipping example (0 to 2 kg = EUR 5, over 2 to 10 kg = EUR 9, over 10 kg = EUR 15; weight must be greater than 0), using the 2-value boundary value analysis at the boundary of 2 kg (input granularity 0.01 kg), which pair of values should be tested?
2.00 kg and the smallest value just above it (2.01 kg).
Correct: the boundary and its nearest neighbour.
Only 2.00 kg.
Wrong: 2-value BVA needs two values.
0 kg and 10 kg.
Wrong: those are not the neighbours of the 2 kg boundary.
1 kg and 3 kg.
Wrong: these are not adjacent to the boundary at the given granularity.
2-value BVA tests the boundary value and its nearest neighbour on the other side: 2.00 and 2.01 kg.
Using the 3-value boundary value analysis for the boundary at 10 kg in the shipping example (input granularity 0.1 kg), which set of values should be tested?
9.9, 10.0 and 10.1 kg.
Correct: boundary plus both neighbours.
10.0 and 10.1 kg only.
Wrong: that is the 2-value approach, missing 9.9.
9.0, 10.0 and 11.0 kg.
Wrong: 9.0 and 11.0 are not the nearest neighbours at 0.1 granularity.
10.0 kg only.
Wrong: 3-value BVA needs three values.
3-value BVA tests the boundary plus the neighbours on both sides: 9.9, 10.0, 10.1.
A registered customer places an order of EUR 120 and applies a valid coupon. Use the decision table below to determine which rule applies and the resulting actions.
Rule R1: free shipping AND an extra 10% discount.
Correct: all three conditions are true, matching column R1.
Rule R2: free shipping only.
Wrong: R2 has no coupon, but the customer applied one.
Rule R5: free shipping only, no extra discount.
Wrong: R5 is for a non-registered customer.
Rule R3: extra discount but no free shipping.
Wrong: R3 has order below EUR 100, but this order is EUR 120.
Registered = T, Order >= 100 = T, Coupon = T matches rule R1: free shipping AND extra 10% discount.
Using the same decision table, a non-registered customer places an order of EUR 60 and applies a coupon. Which rule applies and what is the outcome?
Rule R7: no free shipping and no extra discount.
Correct: F/F/T matches column R7, both actions N.
Rule R3: extra discount only.
Wrong: R3 is for a registered customer.
Rule R5: free shipping only.
Wrong: R5 needs order >= EUR 100, but this order is EUR 60.
Rule R8: free shipping only.
Wrong: R8 has no coupon and grants no free shipping.
Registered = F, Order >= 100 = F, Coupon = T matches rule R7: no free shipping and no extra discount.
What is the minimum number of test cases required to achieve full decision-table coverage for a table with 8 unique, non-redundant rules (columns)?
Eight — one test case per rule (column).
Correct: full coverage needs one test per non-redundant rule.
Four.
Wrong: that would cover only half the rules.
Sixteen.
Wrong: 8 non-redundant rules need only 8 tests.
Two — one for true and one for false.
Wrong: that ignores the rule combinations.
Full decision-table coverage = one test case per rule/column.
Using the state transition diagram below for an order's lifecycle, which of the following is a VALID sequence of transitions?
New -> Paid -> Shipped -> Delivered.
Correct: each transition exists in the diagram.
New -> Shipped -> Delivered.
Wrong: there is no direct New -> Shipped transition.
Paid -> Delivered.
Wrong: the order must be shipped before delivery.
Delivered -> Shipped -> Paid.
Wrong: these are backward transitions that do not exist.
The only valid full path is New -> Paid -> Shipped -> Delivered.
For the order state machine, what does achieving 100% valid transition coverage (0-switch / Chow's N=0) require?
Exercising every valid single transition between states at least once.
Correct definition of 0-switch coverage.
Exercising every pair of consecutive transitions.
Wrong: that is 1-switch coverage.
Visiting every state at least once but not necessarily every transition.
Wrong: that is state coverage, weaker than transition coverage.
Testing only the start and final states.
Wrong: far too weak to be any meaningful coverage.
0-switch coverage requires exercising every valid single transition at least once.
A code module contains one IF statement with an ELSE branch. A single test executes only the TRUE branch. Which statement about coverage is correct?
Branch coverage is 50% and statement coverage is below 100% because the ELSE branch statements are not executed.
Correct: one of two branches taken, and ELSE statements remain unexecuted.
Both statement and branch coverage are 100%.
Wrong: the ELSE branch and its statements are untested.
Statement coverage is 100% but branch coverage is 50%.
Wrong: statements in the ELSE branch are not executed, so it is below 100%.
Branch coverage is 100% but statement coverage is 50%.
Wrong: only one of two branches was taken.
With only the TRUE branch run, the ELSE statements are not executed, so branch coverage is 50% and statement coverage is below 100%.
Which statement about the relationship between statement and branch coverage is correct?
100% branch coverage guarantees 100% statement coverage, but not vice versa.
Correct: branch coverage subsumes statement coverage.
100% statement coverage guarantees 100% branch coverage.
Wrong: an IF without ELSE can reach 100% statements yet miss the false branch.
The two are always equal.
Wrong: they differ when there are branches without statements.
There is no relationship between them.
Wrong: branch coverage subsumes statement coverage.
100% branch coverage implies 100% statement coverage, but not the reverse.
Which TWO of the following would typically be documented in a test plan? (Choose two.)
The scope, objectives and test approach.
Core content of a test plan.
Entry and exit criteria for the test activities.
Test plans define the conditions for starting and finishing testing.
The full source code of the application.
Source code belongs in the code repository, not the test plan.
The company's overall marketing strategy.
Marketing strategy is unrelated to the test plan.
A test plan typically defines the scope and objectives, the test approach, entry/exit criteria, schedule and resources. It does not contain the source code or the marketing strategy.
A test manager estimates a testing task using the three-point technique. The optimistic estimate (a) is 4 days, the most likely (m) is 7 days, and the pessimistic (b) is 16 days. Using E = (a + 4m + b) / 6, what is the estimate?
8 days.
Correct: (4 + 28 + 16) / 6 = 48 / 6 = 8.
9 days.
Wrong: recompute (4 + 28 + 16) / 6 = 8.
7 days.
Wrong: 7 is the most likely value, not the weighted estimate.
10 days.
Wrong: that overestimates the weighted average.
E = (4 + 4*7 + 16) / 6 = 48 / 6 = 8 days.
Using the three-point estimation technique with optimistic = 5, most likely = 9 and pessimistic = 19 (person-days), what is the expected estimate E = (a + 4m + b) / 6?
10 person-days.
Correct: (5 + 36 + 19) / 6 = 60 / 6 = 10.
9 person-days.
Wrong: 9 is the most likely value, not the weighted estimate.
11 person-days.
Wrong: recompute (5 + 36 + 19) / 6 = 10.
12 person-days.
Wrong: that overestimates the weighted average.
E = (5 + 4*9 + 19) / 6 = 60 / 6 = 10 person-days.
In risk-based testing, how is the level of a product risk typically determined?
By combining the likelihood of the risk occurring with the impact if it does.
Correct: risk level = likelihood x impact.
Only by the likelihood of occurrence.
Wrong: impact must also be considered.
Only by the cost of the test cases.
Wrong: test cost does not define product risk.
By the number of testers available.
Wrong: staffing does not determine risk level.
Risk level = likelihood x impact.
Which of the following are examples of EXIT criteria (definition of done) for a test level? (Choose TWO.)
All planned tests have been executed.
Correct: completion of planned tests is an exit criterion.
The agreed coverage and defect thresholds are met.
Correct: meeting coverage/defect targets is an exit criterion.
The test environment is available and stable.
Wrong: that is an entry criterion (prerequisite).
Requirements have been reviewed and baselined.
Wrong: that is an entry criterion.
Exit criteria describe when testing can stop; entry criteria describe prerequisites to start.
Which information is essential in a good defect report? (Choose TWO.)
Steps to reproduce the problem.
Correct: reproduction steps let developers confirm and fix the defect.
Expected result and actual result.
Correct: the discrepancy defines the defect.
The home address of the developer who must fix it.
Wrong: irrelevant and inappropriate.
A guaranteed promise of when it will be fixed.
Wrong: a defect report does not guarantee fix dates.
Steps to reproduce and expected vs actual results are essential for a useful defect report.
A spelling mistake on the company's home page is highly visible to all visitors but does not affect functionality. How would this defect typically be classified?
Low severity but potentially high priority.
Correct: no functional impact (low severity) but visible, so urgent (high priority).
High severity and high priority.
Wrong: there is no functional impact, so severity is not high.
High severity but low priority.
Wrong: severity is low (cosmetic), and a visible homepage error is not low priority.
Low severity and low priority, never worth fixing.
Wrong: high visibility makes it worth fixing quickly.
Severity (technical effect) is low, but priority (urgency to fix) can be high due to visibility.
Which of the following are typically part of a test plan? (Choose TWO.)
The scope, objectives and approach of testing.
Correct: core content of a test plan.
Entry and exit criteria.
Correct: a test plan defines start and stop conditions.
The exact source code of the application under test.
Wrong: source code is not part of a test plan.
The personal salaries of the test team.
Wrong: irrelevant to a test plan.
A test plan documents scope/objectives/approach and entry/exit criteria.
Which metric is most useful for monitoring test execution progress?
The number of test cases planned, executed, passed and failed over time.
Correct: a standard test-monitoring metric.
The number of lines of code written by developers.
Wrong: that measures development, not test progress.
The number of meetings held by the project manager.
Wrong: irrelevant to test execution progress.
The age of the test environment hardware.
Wrong: not a measure of test progress.
Tracking planned/executed/passed/failed test cases over time shows execution progress.
Which of the following are risks or limitations of introducing test automation tools? (Choose TWO.)
Underestimating the effort needed to maintain the automated scripts.
Correct: maintenance is a well-known automation risk.
Over-reliance on the tool or expecting unrealistic benefits.
Correct: unrealistic expectations are a recognised risk.
The tool eliminates the need for any testing.
Wrong: tools support, they do not replace testing.
Tools always reduce total cost immediately.
Wrong: benefits often take time and initial investment.
Common risks: underestimating maintenance effort and over-reliance / unrealistic expectations.
A tool that records testers' manual actions in a browser and generates a replayable script belongs to which category?
Test execution / automation tools (capture-playback).
Correct: record-and-playback is an execution/automation tool.
Static analysis tools.
Wrong: static analysis examines code without executing it.
Test management tools.
Wrong: those manage tests/defects, not record browser actions.
Performance testing tools.
Wrong: those generate load, not capture single-user actions.
Capture-playback tools are a kind of test execution / automation tool.