ISTQB Foundation (CTFL v4.0) Mock Exam #8 — Questions & Answers
Every question in this mock exam, with the correct answer marked and a written rationale behind each option below — for reading and review, not a timed run.
Which of the following is NOT one of the seven testing principles defined in the ISTQB Foundation syllabus?
Exhaustive testing guarantees a defect-free product
Correct choice: this is NOT a principle. The real principle states the opposite — exhaustive testing is impossible except for trivial cases.
Testing shows the presence, not the absence, of defects
This is a genuine ISTQB principle, so it is not the answer.
Defects cluster together
This is a genuine principle (defect clustering), so it is not the answer.
Testing is context dependent
This is a genuine principle, so it is not the answer.
A team runs tests primarily to build confidence in the quality of a release before shipping. Which testing objective does this BEST illustrate?
Building confidence in the level of quality of the test object
Correct: gaining confidence in quality is an explicitly listed objective of testing.
Proving that the software contains no defects
Incorrect: testing can never prove the absence of defects.
Replacing the need for requirements reviews
Incorrect: dynamic testing does not replace static reviews of requirements.
Guaranteeing the project schedule
Incorrect: testing informs decisions but does not guarantee schedules.
A developer makes a typing mistake in a condition. The faulty code is later executed and the program shows an incorrect result to the user. Using ISTQB terminology, what is the incorrect result shown to the user?
A failure
Correct: the externally observed incorrect behaviour is a failure (Fehlerwirkung).
An error
Incorrect: the error (mistake) was the human typing action, not the visible result.
A defect
Incorrect: the defect is the flaw in the code itself, not its observed effect.
A root cause
Incorrect: the root cause is the underlying reason for the error, not the visible result.
Which statement BEST distinguishes testing from debugging?
Testing can trigger failures caused by defects; debugging finds, analyses and fixes those defects
Correct: testing reveals failures, debugging is the development activity that locates and removes the underlying defect.
Testing and debugging are two names for the same activity
Incorrect: they are distinct activities with different goals.
Debugging is performed only by testers, never by developers
Incorrect: debugging is typically a developer activity.
Testing fixes defects while debugging only reports them
Incorrect: this reverses the roles of the two activities.
Why is testing necessary? Select TWO statements that correctly describe a contribution of testing.
Testing reduces the risk of failures occurring in operation
Correct: a core reason for testing is risk reduction for the operational product.
Testing can help meet contractual or legal requirements and standards
Correct: compliance with contracts, laws and standards is a recognised reason for testing.
Testing proves the software is completely correct
Incorrect: testing cannot prove total correctness.
Testing removes the need for quality assurance processes
Incorrect: testing is part of quality control and complements, not replaces, QA.
A test suite that found many defects a year ago now rarely finds new ones, even though the product keeps changing. Which principle explains this, and what is the recommended response?
The pesticide paradox — review and revise the tests, and add new ones
Correct: repeating the same tests stops finding new defects; tests must be reviewed and updated.
Defect clustering — stop testing the changed areas
Incorrect: clustering would not justify stopping testing of changed areas.
Exhaustive testing — run every possible test
Incorrect: exhaustive testing is impossible and not the explanation here.
Testing is context dependent — change the test environment
Incorrect: context dependence is unrelated to tests losing effectiveness over time.
A system passes all of its tests and contains very few defects, yet users reject it because it does not meet their actual needs. Which principle does this situation illustrate?
The absence-of-errors fallacy
Correct: a system can be nearly defect-free yet still fail to meet user needs and expectations.
Early testing saves time and money
Incorrect: this principle concerns when to start testing, not user fitness.
Defects cluster together
Incorrect: clustering describes defect distribution, not fitness for use.
Testing is context dependent
Incorrect: context dependence does not explain a defect-free system being rejected.
During test analysis and test design a team defines measurable attributes of the test object that have to be exercised, so that coverage can later be reported as a percentage. In ISTQB terminology, what are such attributes called?
Test coverage items
Correct — coverage items are the measurable attributes derived from test conditions and are the basis for expressing coverage as a percentage.
Test conditions
Test conditions state which aspects of the test object should be tested. Coverage items are derived from them and are the part that is actually counted and measured.
Exit criteria
Exit criteria are the conditions for deciding whether testing may stop. A coverage target can be part of them, but the exit criteria are not themselves the measurable attributes of the test object.
Test data
Test data are the values a test case needs when it is executed. They support the tests but do not express how much of the test object has been exercised.
Test coverage items are the measurable attributes derived from test conditions; coverage is expressed as the percentage of coverage items exercised by the executed tests.
In a sequential (V-model) lifecycle, which test level is MOST closely associated with the system requirements specification?
System testing
Correct: in the V-model, system testing is derived from and verifies the system requirements specification.
Component testing
Incorrect: component testing relates to the component/detailed design, not system requirements.
Component integration testing
Incorrect: this level relates to the technical/architectural design.
Acceptance testing
Incorrect: acceptance testing is associated with business requirements and user needs, not the system requirements specification.
A tester checks whether a new reporting feature returns correct totals for various input data sets. Which test type is being performed?
Functional testing
Correct: verifying what the system does (correct totals) against functional requirements is functional testing.
Non-functional testing
Incorrect: non-functional testing covers how well the system works (e.g., performance), not correctness of results.
White-box testing
Incorrect: this describes a test basis (code structure), not the goal of checking computed totals.
Confirmation testing
Incorrect: confirmation testing re-runs tests after a fix, which is not described here.
After a defect fix is delivered, a tester first re-runs the exact test that originally failed, then runs a set of previously passing tests around the changed area. What are these two activities, in order?
Confirmation testing, then regression testing
Correct: confirmation testing verifies the fix; regression testing checks no new defects were introduced elsewhere.
Regression testing, then confirmation testing
Incorrect: the order is reversed; the fix is confirmed first.
Retesting, then maintenance testing
Incorrect: 'retesting' is a synonym for confirmation, but the second activity here is regression, not maintenance testing.
Smoke testing, then confirmation testing
Incorrect: a smoke test is a broad sanity check, not the targeted re-run of the failed test.
Which situation would typically trigger maintenance testing?
Migrating a live system to a new operating platform
Correct: migration of an operational system is a recognised trigger for maintenance testing.
Writing unit tests for a brand-new component during initial development
Incorrect: this is component testing during development, not maintenance.
Defining acceptance criteria before coding begins
Incorrect: this is an early test activity, unrelated to maintenance of an existing system.
Reviewing the requirements document for ambiguities
Incorrect: this is static testing, not maintenance testing.
Which TWO statements describe characteristics of testing within an Agile/iterative development approach?
Testing activities occur in every iteration, integrated with development
Correct: in iterative approaches testing is continuous and integrated, not a final phase.
Automated regression testing is important to keep pace with frequent changes
Correct: frequent iterations make automated regression testing valuable to manage change.
All testing is deferred until after the final iteration
Incorrect: deferring all testing contradicts the iterative, continuous nature of Agile.
Test documentation must always be more formal than in sequential models
Incorrect: Agile typically uses lighter documentation, not more formal documentation.
A team adopts a 'shift-left' approach to testing. What does this primarily mean?
Performing testing activities earlier in the lifecycle
Correct: shift-left means moving test activities earlier, e.g., reviewing requirements and writing tests before code is complete.
Moving all testing to a dedicated team after release
Incorrect: this is the opposite of shifting left.
Reducing the total number of tests to save time
Incorrect: shift-left concerns timing of testing, not reducing test count.
Testing only the left-hand modules of the architecture
Incorrect: shift-left has nothing to do with the spatial layout of modules.
Which TWO of the following are benefits of static testing? (Choose two.)
Detecting and correcting defects earlier and more cheaply.
Finding defects in early work products reduces the cost of fixing them.
Finding defects that may be difficult to expose by dynamic testing.
Reviews can catch ambiguous requirements or unreachable code that execution may miss.
Measuring the actual response time of the running system.
Measuring runtime behaviour requires dynamic testing.
Proving that the software has no remaining defects.
No technique can prove the absence of defects.
Static testing detects defects early (cheaper to fix) and can find defects that are hard to reveal by dynamic testing, such as unreachable code or inconsistent requirements.
Which is a key benefit of static testing compared with dynamic testing?
Defects can be found early, before code is executed
Correct: static testing examines work products without execution, allowing very early defect detection.
It measures the system's runtime performance
Incorrect: runtime performance requires dynamic testing.
It can only be applied to source code
Incorrect: static testing applies to many work products (requirements, designs, test cases), not only code.
It guarantees that integration defects cannot occur
Incorrect: static testing cannot guarantee the absence of integration defects.
A review is conducted following a documented procedure, with defined roles, a trained moderator, individual preparation using checklists, and formal metrics on defects found. Which review type is this?
Inspection
Correct: a formal process with roles, a trained moderator, preparation and metrics is characteristic of an inspection.
Informal review
Incorrect: an informal review has no defined process, roles or metrics.
Walkthrough
Incorrect: a walkthrough is led by the author and is less formal, without mandatory metrics and trained moderation.
Ad hoc review
Incorrect: ad hoc reviewing has no preparation, procedure or roles.
In a formal review, who is responsible for leading the review, planning it and ensuring the procedure is followed?
The facilitator (moderator)
Correct: the facilitator/moderator leads the review, plans it and ensures the process is followed.
The author
Incorrect: the author creates and fixes the work product but does not lead the review.
The scribe
Incorrect: the scribe records the findings, not leads the review.
The reviewer
Incorrect: reviewers identify issues but do not lead or plan the review.
A non-member places an order totalling $40 and selects express shipping. Using the decision table below, which shipping fee does the system apply?
$15
No member, order under $50, express shipping matches rule R7, whose action is $15.
$10
$10 is rule R3 or R5, which require a member or an order >= $50.
$8
$8 is rule R8, which applies only without express shipping.
$5
$5 corresponds to non-express rules (R4/R6), not this combination.
Member? = No, Order >= $50? = No ($40), Express shipping? = Yes → rule R7 → $15.
Submitted → Screening → Interview → Offer → Hired (4 transitions)
This is the only route reaching Hired and it uses four transitions.
Submitted → Screening → Offer → Hired (3 transitions)
There is no direct Screening → Offer transition; Interview cannot be skipped.
Submitted → Interview → Offer → Hired (3 transitions)
Submitted goes only to Screening first; there is no Submitted → Interview transition.
Submitted → Screening → Interview → Offer → Declined → Hired (5 transitions)
Declined is a final state with no outgoing transition, so it cannot lead to Hired.
The only path to Hired is Submitted →(review) Screening →(pass) Interview →(pass) Offer →(accept) Hired = 4 transitions.
In the media-player state machine, the player is currently in the Playing state. Which event would be an INVALID (undefined) transition from Playing?
play
Correct — there is no 'play' transition leaving the Playing state.
pause
Wrong — 'pause' is a valid transition Playing→Paused.
stop
Wrong — 'stop' is a valid transition Playing→Stopped.
Both pause and stop
Wrong — both are valid transitions from Playing, so neither is invalid.
From Playing, only 'pause' (→Paused) and 'stop' (→Stopped) are defined. 'play' has no transition from Playing, so it is invalid.
A web form accepts a 'quantity' field for an online order. The specification says: quantity must be an integer from 1 to 99; values of 0 or below are rejected with the message 'minimum is 1'; values of 100 or above are rejected with 'maximum is 99'; non-integer input is rejected as invalid. Using equivalence partitioning, how many equivalence partitions exist for the quantity field, and what is the MINIMUM number of test cases needed to cover each partition once?
4 partitions, 4 test cases
Correct: valid integers 1–99, integers ≤0, integers ≥100, and non-integers = 4 partitions; each covered once needs 4 test cases.
3 partitions, 3 test cases
Incorrect: this overlooks the separate non-integer (invalid) partition.
2 partitions, 2 test cases
Incorrect: this only counts 'valid' and 'invalid' without separating the distinct invalid behaviours.
4 partitions, 8 test cases
Incorrect: covering each partition once requires one test per partition, i.e., 4, not 8.
A field accepts an integer percentage that is valid from 0 to 100 inclusive. The team applies two-value boundary value analysis (testing each boundary value and the value just outside it). Considering both the lower and upper boundaries, which set of input values should be selected?
-1, 0, 100, 101
Correct: two-value BVA tests each boundary (0 and 100) plus the adjacent outside value (-1 and 101).
0, 50, 100
Incorrect: 50 is a mid-partition value and the just-outside boundary values are missing.
-1, 1, 99, 101
Incorrect: the actual boundary values 0 and 100 are omitted; 1 and 99 are not the boundaries.
-1, 0, 1, 99, 100, 101
Incorrect: this is three-value BVA; two-value BVA does not include 1 and 99.
The decision table below specifies a loan pre-approval engine (T = condition true, F = false, – = don't care, X = action taken). Examine the table, then answer: an applicant is 25 years old, has a credit score of 720, a monthly income of 4000, and an existing loan. Which rule applies and what is the resulting action?
Rule R4 — Reject
Correct: all four conditions are true (age, score, income) with an existing loan = R4, action Reject.
Rule R5 — Approve standard rate
Incorrect: R5 requires NO existing loan (C4 = F); here C4 = T.
Rule R6 — Approve premium rate
Incorrect: R6 also requires no existing loan; the existing loan rules it out.
Rule R3 — Reject
Incorrect: R3 requires income below 3000 (C3 = F); here income is 4000, so C3 = T.
Reading the table: C1 (age ≥ 18) = T, C2 (credit score ≥ 700) = T, C3 (income ≥ 3000) = T, C4 (existing loan) = T. This matches rule R4, whose action is 'Reject'.
Which black-box test technique is MOST appropriate when the behaviour of a system depends on combinations of several independent input conditions, each of which can be true or false?
Decision table testing
Correct: decision tables systematically capture combinations of conditions and their resulting actions.
Boundary value analysis
Incorrect: BVA targets the edges of ordered ranges, not combinations of boolean conditions.
State transition testing
Incorrect: state transition testing models events and states over time, not static combinations of conditions.
Statement testing
Incorrect: statement testing is a white-box technique based on code, not input condition combinations.
Which statement about white-box (structure-based) test techniques is correct?
Coverage measures the extent to which the code structure has been exercised by tests
Correct: structural coverage (e.g., statement, branch) quantifies how much of the code was executed.
100% branch coverage guarantees the absence of all defects
Incorrect: high coverage reduces risk but never guarantees a defect-free product.
White-box techniques require no knowledge of the code
Incorrect: white-box techniques are based on the internal structure of the code.
Achieving 100% statement coverage always implies 100% branch coverage
Incorrect: branch coverage is stronger; full statement coverage can leave branches uncovered.
An experienced tester, drawing on knowledge of defects that typically occur in similar applications, deliberately enters empty fields, very long strings and special characters to provoke failures. Which experience-based technique is this?
Error guessing
Correct: anticipating likely mistakes and crafting inputs to expose them is error guessing.
Boundary value analysis
Incorrect: BVA is a systematic black-box technique based on range edges, not experience-based guessing.
Decision table testing
Incorrect: decision tables systematically model condition combinations, not intuitive defect guessing.
Statement testing
Incorrect: statement testing is a white-box technique based on code coverage.
Which description BEST characterises exploratory testing?
Test design, execution and learning happen concurrently, often guided by a test charter
Correct: exploratory testing interleaves learning, design and execution, frequently time-boxed and charter-guided.
All test cases are fully scripted and documented before execution
Incorrect: that describes scripted testing, the opposite of exploratory testing.
It is a structure-based technique requiring source code access
Incorrect: exploratory testing is experience-based, not structure-based.
It can only be performed by automated tools
Incorrect: exploratory testing is primarily a human, skill-driven activity.
Which test basis is MOST directly used to derive tests with the use-case testing technique?
Use cases describing actor-system interactions, including main and alternative flows
Correct: use-case testing derives tests from the basic flow and the alternative/exception flows of a use case.
The source code control flow graph
Incorrect: that is the basis for white-box techniques, not use-case testing.
A list of equivalence partitions for a single input field
Incorrect: that supports equivalence partitioning, not use-case testing.
A state transition diagram of internal modes
Incorrect: that is the basis for state transition testing.
Which of the following is typically documented in a test plan?
The test objectives, scope, approach and entry/exit criteria
Correct: a test plan describes objectives, scope, the approach, schedule, resources and entry/exit criteria.
The exact source code of every fix
Incorrect: source code is not part of a test plan.
The marketing budget for the product launch
Incorrect: marketing budgets are unrelated to a test plan.
The personal performance reviews of the testers
Incorrect: HR performance reviews are not part of a test plan.
A team agrees that system testing may not begin until the build is deployed to the test environment and a smoke test passes. How are these conditions BEST classified?
Entry criteria
Correct: conditions that must be met before a test activity can start are entry criteria.
Exit criteria
Incorrect: exit criteria define when testing can stop, not when it may start.
Test conditions
Incorrect: a test condition is an item to be verified, not a precondition for starting an activity.
Test data requirements
Incorrect: these are environment/quality gates, not data requirements.
A test manager estimates the effort to test a feature using the three-point (PERT) technique. The most optimistic estimate is 5 days, the most likely is 8 days, and the most pessimistic is 17 days. Using the formula E = (a + 4m + b) / 6, what is the estimated effort?
9 days
Correct: (5 + 4×8 + 17) / 6 = (5 + 32 + 17) / 6 = 54 / 6 = 9 days.
10 days
Incorrect: this is the simple average (5+8+17)/3 = 10, not the weighted PERT estimate.
8 days
Incorrect: 8 is the most likely value alone, ignoring the optimistic and pessimistic weighting.
11 days
Incorrect: 54/6 = 9, not 11; recompute the weighted sum.
Which of the following is a PRODUCT risk rather than a project risk?
The payment module may miscalculate tax under certain conditions
Correct: a possible failure of the software to meet a quality need is a product risk.
A key tester might leave the team mid-project
Incorrect: staffing problems are a project risk, not a product risk.
The test environment delivery may be delayed
Incorrect: a delivery delay is a project risk.
The budget for tooling might be cut
Incorrect: a budget cut is a project (management) risk.
A team uses risk-based testing. Four product risks have been rated on likelihood (L) and impact (I), each on a 1–5 scale, with risk level = L × I: – R1: L=2, I=5 – R2: L=4, I=4 – R3: L=5, I=2 – R4: L=3, I=3 With limited time, which risk should receive the MOST testing effort first?
R2 (risk level 16)
Correct: R2 = 4×4 = 16, the highest of R1=10, R3=10, R4=9, so it is prioritised first.
R1 (risk level 10)
Incorrect: R1 = 2×5 = 10, lower than R2's 16.
R3 (risk level 10)
Incorrect: R3 = 5×2 = 10, equal to R1 but below R2.
R4 (risk level 9)
Incorrect: R4 = 3×3 = 9, the lowest risk level of the four.
Which information is ESSENTIAL in a well-written defect report to enable the developer to reproduce the problem?
Steps to reproduce, plus the expected and actual results
Correct: reproduction steps with expected vs actual results are essential to diagnose and fix a defect.
The tester's opinion of who is to blame
Incorrect: assigning blame is not useful and not part of a good defect report.
A guess at the exact line of code that is wrong
Incorrect: a speculative code line is not required and may mislead; reproduction details matter most.
The total number of defects found that day
Incorrect: daily totals are a metric, not information needed to reproduce a specific defect.
Which TWO of the following are commonly used test monitoring metrics?
Percentage of planned test cases executed
Correct: test case execution progress is a standard monitoring metric.
Number of defects found, fixed and still open
Correct: defect counts and status are widely used to monitor test progress and product quality.
The number of office desks in the test team room
Incorrect: this is irrelevant to test monitoring.
The personal hobbies of the developers
Incorrect: developers' hobbies are not a test metric.
Why is configuration management important to support testing?
It ensures testware and test objects are uniquely identified, version-controlled and traceable
Correct: configuration management keeps the identity and versions of test items and testware under control, so results are reproducible.
It automatically fixes all defects found during testing
Incorrect: configuration management does not fix defects.
It replaces the need for a test plan
Incorrect: configuration management complements but does not replace planning.
It guarantees 100% test coverage
Incorrect: configuration management has no bearing on coverage levels.
Which TWO statements correctly describe the value and the limitation of independent testing?
Independent testers may recognise different kinds of failures than the author due to different assumptions
Correct: independence brings a fresh perspective, helping reveal defects the author might overlook.
Independence can cause communication barriers and isolation from the development team
Correct: a recognised drawback is reduced collaboration and a possible 'us vs them' dynamic.
Independent testing guarantees that no defects remain in the product
Incorrect: no form of testing can guarantee a defect-free product.
Developers are incapable of finding any defects in their own work
Incorrect: developers can and do find defects in their own work; independence is complementary, not a replacement.
A team wants a tool that automatically executes pre-recorded test scripts against the application and compares actual outputs with expected results. Which tool category is this?
Test execution tool
Correct: test execution tools run scripted tests and compare actual against expected results.
Static analysis tool
Incorrect: static analysis examines code without executing it.
Test management tool
Incorrect: test management tools organise test artefacts and reporting, not script execution and comparison.
Performance testing tool
Incorrect: performance tools generate load and measure response, not functional output comparison of scripts.
Which TWO are genuine risks or costs of introducing test automation that teams should plan for?
Ongoing effort is needed to maintain automated scripts as the application changes
Correct: maintenance of automated tests is a real, recurring cost that is easy to underestimate.
Expectations of the tool's benefits may be unrealistic, and initial setup demands time and skills
Correct: over-optimistic expectations and significant initial investment in skills and setup are recognised tool risks.
Automation always removes the need for any human testers
Incorrect: automation supports testers but does not eliminate the need for human testing and judgement.
Automated tests are guaranteed to find more defects than manual testing in every case
Incorrect: automation excels at repetition but does not guarantee finding more defects than skilled manual testing.