Skip to content
ISTQB
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

ISTQB Online Assessment Questions & Answers

40 questions for the online assessment stage — 22 easy, 16 medium, 2 hard.

About the online assessment round

Most companies start with an online test: aptitude and reasoning, a few MCQs on core ISTQB concepts, and one or two short hands-on tasks. It filters a large number of applicants, so speed and accuracy both count.

Tips for the online assessment round

  • Practise under a timer: about one minute per MCQ and 15-20 minutes per hands-on task.
  • Read every option before answering; tests often include two nearly correct choices.
  • Use a stable internet connection, keep your camera on and avoid switching tabs in proctored tests.
  • Attempt the questions you are sure about first, then return to the harder ones.
Solved — online assessmentStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How many tests are needed for full statement and branch coverage of this nested code?

White-Box, Experience and Collaboration-Based TestingMedium
Save to ▾
Show answer
if a > 0: if b > 0: s1 else: s2 else: s3 Statement coverage needs 3 tests, because s1, s2 and s3 are on different paths. Branch coverage also needs 3: (a > 0, b > 0), (a > 0, b <= 0) and (a <= 0). With full if-else structures, both criteria need the same number of tests.
02

Show the TDD red-green-refactor cycle with a small example.

Testing Throughout the SDLCMedium
Save to ▾
Show answer
# Red: write a failing test first def test_discount(): assert discount(1000) == 100 # Green: simplest code that passes def discount(amount): return amount * 0.10 # Refactor: improve design, test stays green RATE = 0.10 def discount(amount): return round(amount * RATE, 2) Repeat the cycle for each new behaviour, such as no discount below 500.
03

Explain the absence-of-defects fallacy.

Fundamentals of TestingEasy
Save to ▾
Show answer
It is a misconception that verifying software thoroughly and fixing every found defect guarantees success. A system can pass every test against its specification and still be useless if the specification was wrong or the users' real needs were missed. That is why testing must include validation as well as verification, for example early review of requirements with business stakeholders and user acceptance testing before release.
04

An age field accepts 18 to 60. Apply equivalence partitioning. How many tests give 100 percent EP coverage?

Black-Box Test TechniquesEasy
Save to ▾
Show answer
There are three partitions: below 18 (invalid), 18 to 60 (valid) and above 60 (invalid). Pick one value from each, for example 10, 35 and 70. So three test cases give 100 percent EP coverage. Test invalid partitions one at a time so that one invalid value does not hide another, and confirm with the specification whether non-numeric input forms another invalid partition.
05

Which work products can be examined by static testing?

Static TestingEasy
Save to ▾
Show answer
Almost any work product that can be read and understood: requirements, user stories, acceptance criteria, architecture and design documents, source code, test plans, test cases, test charters, backlog items, contracts, project plans, schedules and budgets. Static analysis tools need work products with a formal structure, such as code or models with defined syntax. Products that are hard for humans to interpret, like third-party executable code, are not suitable for review.
06

What do the K-levels K1, K2 and K3 mean in the CTFL syllabus?

Test Tools and Exam PreparationEasy
Save to ▾
Show answer
K-levels describe the cognitive level of each learning objective. K1 is remember: recall a term or fact, such as listing test levels. K2 is understand: explain, compare, classify or give examples, such as distinguishing project and product risks. K3 is apply: use a procedure in a given situation, such as deriving boundary values or calculating a three-point estimate. Most exam questions are K2.
07

Name the main test activities in the ISTQB test process.

Fundamentals of TestingEasy
Save to ▾
Show answer
The test process has seven activity groups: test planning, test monitoring and control, test analysis, test design, test implementation, test execution and test completion. They are often iterative or done in parallel rather than strictly sequential. How they are carried out depends on context, such as the SDLC, product risks, budget, time, team skills and regulations, so an Agile team performs them in small loops in every iteration.
08

A password must be 8 to 16 characters long. What are the 2-value BVA tests?

Black-Box Test TechniquesEasy
Save to ▾
Show answer
The partitions by length are 0 to 7 (invalid), 8 to 16 (valid) and 17 or more (invalid). 2-value BVA takes each boundary and its closest neighbour: 7 and 8 for the lower boundary, 16 and 17 for the upper boundary. So test passwords of length 7, 8, 16 and 17 characters, keeping other rules such as character types valid so only the length varies.
09

What categories of test tools does CTFL v4.0 describe?

Test Tools and Exam PreparationEasy
Save to ▾
Show answer
Test management tools, static testing tools, test design and implementation tools, test execution and coverage tools, non-functional testing tools, DevOps tools such as CI/CD pipelines and build tools, collaboration tools, and tools supporting scalability and deployment standardisation such as virtual machines and containers. Any tool that assists testing counts, even a spreadsheet. Tools improve efficiency, quality and repeatability.
10

What is the difference between confirmation testing and regression testing?

Testing Throughout the SDLCEasy
Save to ▾
Show answer
Confirmation testing checks that an original defect has been fixed, by re-running the failed tests or new tests that cover the change. Regression testing checks that a change, including a fix, has not caused adverse effects elsewhere, in the same component, connected components or the environment. Regression suites grow and run often, so they are strong candidates for automation, typically inside a CI pipeline.
11

Historically, development and test effort are in the ratio 3:2. Development is estimated at 600 person-days. Estimate the test effort.

Managing the Test ActivitiesEasy
Save to ▾
Show answer
This is estimation based on ratios. Test effort = development effort x 2 / 3 = 600 x 2 / 3 = 400 person-days. The ratio must come from similar past projects in the same organisation, because it changes with domain, risk and process maturity. I would also cross-check with another technique, such as Wideband Delphi, before committing to the number.
12

How do retrospectives help testing?

Testing Throughout the SDLCEasy
Save to ▾
Show answer
A retrospective is held at the end of an iteration, release or project to discuss what went well, what did not and how to improve. For testing, the benefits include more effective and efficient testing, better testware, team bonding, better quality of the test basis and stronger cooperation between developers and testers. Results should be recorded and the improvement actions tracked so that they are actually carried out.
13

What are entry and exit criteria? How do they relate to Definition of Ready and Definition of Done?

Managing the Test ActivitiesEasy
Save to ▾
Show answer
Entry criteria define preconditions for starting an activity, such as available resources, testware, a stable build and a test environment. Exit criteria define what must be achieved to finish, such as coverage reached, unresolved defect counts, defect density and passed tests. Running out of time or budget can also be a valid exit. In Agile, exit criteria are often called the Definition of Done and entry criteria for a story the Definition of Ready.
14

Business users test a new payroll system in their own office before go-live. What kind of testing is this?

Testing Throughout the SDLCEasy
Save to ▾
Show answer
This is user acceptance testing, because intended users validate that the system meets their needs in a realistic environment before deployment. If it were a commercial product released to external customers at their own sites for feedback, it would be beta testing. If potential users tested it at the developer's site, it would be alpha testing. Look for who tests and where.
15

Prepare a fault attack list for a file upload feature.

White-Box, Experience and Collaboration-Based TestingHard
Save to ▾
Show answer
List likely failures and design tests for each: empty file; file just above the size limit; very large file; wrong extension; correct extension with wrong content; file names with spaces, Unicode or very long names; duplicate names; upload interrupted by network loss; many uploads at once; malicious files such as scripts; and uploads without login or with an expired session. Prioritise by risk.
16

What is the difference between severity and priority?

Defect and Configuration ManagementEasy
Save to ▾
Show answer
Severity is the degree of impact the defect has on the system or its stakeholders, such as a crash or data loss. Priority is the urgency of fixing it, usually set by the business or product owner. Testers usually suggest severity, and priority is decided in triage. Example: a crash in a rarely used admin report is high severity but may be low priority.
17

How should you answer 'select TWO' questions in the CTFL exam?

Test Tools and Exam PreparationMedium
Save to ▾
Show answer
Read the instruction carefully, because you must select exactly two options and usually get the point only if both are correct. Evaluate each option separately as true or false against the syllabus. Eliminate absolute statements and options that describe a different concept. If you are sure of one, compare the remaining options carefully. These questions appear in the exam, so practise them in sample papers.
18

How do you prioritise risks using a likelihood and impact matrix?

Managing the Test ActivitiesMedium
Save to ▾
Show answer
Score each risk for likelihood and impact on a scale such as 1 to 5, and multiply to get the risk level. Example: wrong interest calculation, likelihood 3 and impact 5, level 15; slow report export, likelihood 4 and impact 2, level 8; spelling errors, 4 and 1, level 4. Test the highest levels first and most deeply, using more rigorous techniques and earlier test execution.
19

Find the minimum tests for statement and branch coverage when there are two independent if statements in sequence.

White-Box, Experience and Collaboration-Based TestingMedium
Save to ▾
Show answer
if a > 0: s1 if b > 0: s2 Statement coverage: one test with a = 1 and b = 1 runs s1 and s2, so 1 test. Branch coverage: each if needs a true and a false outcome. Tests (a = 1, b = 1) and (a = 0, b = 0) cover all four branches, so 2 tests.
20

Suggest a four-week study plan for a fresher preparing for CTFL v4.0.

Test Tools and Exam PreparationEasy
Save to ▾
Show answer
Week 1: chapters 1 and 2, the seven principles, test activities, test levels and test types; make notes of key terms. Week 2: chapter 3 and black-box techniques, solving at least 30 EP, BVA, decision table and state transition problems. Week 3: white-box and experience-based techniques, chapters 5 and 6, with estimation and risk exercises. Week 4: three or more timed sample exams and revision of mistakes.
21

What does a test plan contain according to CTFL v4.0?

Managing the Test ActivitiesEasy
Save to ▾
Show answer
A test plan typically covers: context of testing (scope, objectives, constraints, test basis); assumptions and constraints; stakeholders with roles and responsibilities; communication; a risk register of product and project risks; the test approach (test levels, types, techniques, deliverables, entry and exit criteria, independence, metrics, test data and environments); and budget and schedule. It documents how test objectives will be met and is updated as the project changes.
22

Compare TDD, ATDD and BDD.

Testing Throughout the SDLCMedium
Save to ▾
Show answer
All three are test-first approaches. In TDD, developers write a failing unit test, write code to pass it, then refactor. In ATDD, acceptance tests are derived from acceptance criteria with the team and business before development starts. In BDD, desired behaviour is written as Given/When/Then scenarios in natural language that stakeholders understand and that can be turned into executable tests. All three support shift-left.
23

Calculate a three-point estimate where optimistic is 6, most likely is 9 and pessimistic is 18 person-days.

Managing the Test ActivitiesMedium
Save to ▾
Show answer
E = (a + 4m + b) / 6 = (6 + 4 x 9 + 18) / 6 = (6 + 36 + 18) / 6 = 60 / 6 = 10 person-days SD = (b - a) / 6 = (18 - 6) / 6 = 2 Report the estimate as 10 +/- 2 person-days, which gives a range of 8 to 12.
24

What is static testing and how is it different from dynamic testing?

Static TestingEasy
Save to ▾
Show answer
Static testing examines work products without executing them, through manual reviews or static analysis tools. Dynamic testing executes the software. Static testing finds defects directly, such as ambiguous requirements or coding standard violations, while dynamic testing causes failures whose defects are then located by debugging. Static testing works on non-executable products like requirements and test plans, and finds defects dynamic testing cannot, such as unreachable code.
25

Write a BDD scenario for locking an account after three failed login attempts.

Testing Throughout the SDLCMedium
Save to ▾
Show answer
Feature: Account lockout Scenario: Lock account after three failed attempts Given a registered user with an active account When the user enters a wrong password 3 times in a row Then the account is locked And the message 'Account locked. Try again after 30 minutes' is shown Given sets the context, When is the action and Then is the expected outcome.
26

A decision table has three Boolean conditions. If condition A is false, the result is always 'reject'. How many columns does the minimised table have?

Black-Box Test TechniquesHard
Save to ▾
Show answer
A full table has 2 to the power 3 = 8 columns. When A is false, the other two conditions do not matter, so those four columns merge into one column with dashes for B and C. When A is true, the four combinations of B and C remain. The minimised table has 4 + 1 = 5 columns, so 5 tests give full coverage, if all columns are feasible.
27

What is the difference between verification and validation?

Fundamentals of TestingEasy
Save to ▾
Show answer
Verification checks whether the system meets its specified requirements: 'Are we building the product right?' Validation checks whether the system meets user and stakeholder needs in its operational environment: 'Are we building the right product?' Both are testing objectives. Example: verification confirms the eight-character password rule is implemented, while validation checks that real users can actually register easily on a mobile phone.
28

What is the difference between the test management role and the testing role in CTFL v4.0?

Fundamentals of TestingMedium
Save to ▾
Show answer
v4.0 describes roles, not job titles. The test management role owns the test process, the test team and leadership of test activities, mainly planning, monitoring and control, and completion. The testing role owns the engineering side: test analysis, design, implementation and execution. One person can hold both roles, and in Agile teams some management tasks are done by the team while cross-team coordination may sit with a test manager.
29

Write a sample defect report for a failed coupon code.

Defect and Configuration ManagementEasy
Save to ▾
Show answer
ID: DEF-1042. Title: Checkout - valid coupon SAVE10 rejected as expired. Build: 3.4.1, staging, Chrome 130 on Windows. Preconditions: logged-in user, cart value 1,500 rupees. Steps: open checkout, enter SAVE10, click Apply. Expected: 10 percent discount applied. Actual: error 'Coupon expired' although valid until 31 December. Attachments: screenshot, console log. Severity: major. Priority: high. Reference: TC-CHK-018.
30

In the CTFL exam you have ten questions left and only five minutes. What should you do?

Test Tools and Exam PreparationEasy
Save to ▾
Show answer
There is no negative marking, so never leave a question blank. Quickly answer the easier ones first, eliminate obviously wrong options on the rest and pick the best remaining choice. Flag nothing new for review now. To avoid this situation, aim to spend about one minute per question in the first pass and skip long calculation questions to revisit later.
31

A field accepts integers from 1 to 99. Which set of values achieves 100 percent 2-value BVA coverage: {1, 99}, {0, 1, 99, 100}, {0, 50, 100} or {1, 2, 98, 99}?

Black-Box Test TechniquesEasy
Save to ▾
Show answer
The answer is {0, 1, 99, 100}. Two-value BVA needs each boundary value and its closest neighbour in the adjacent partition: 0 and 1 at the lower edge, 99 and 100 at the upper edge. {1, 99} misses the invalid neighbours, {0, 50, 100} misses 1 and 99, and {1, 2, 98, 99} stays inside the valid partition, which is closer to 3-value thinking.
32

Describe a typical defect life cycle.

Defect and Configuration ManagementEasy
Save to ▾
Show answer
A defect is logged as new or open, then triaged: it may be rejected, marked duplicate or deferred, or assigned for fixing. After the developer fixes it, it moves to awaiting confirmation testing. The tester re-tests; if it passes, the defect is closed, and if it fails, it is re-opened. Teams customise the workflow, but each status should have clear rules about who can move it and when.
33

Build a decision table for a loan rule: approve if salary is at least 30,000 and credit score is at least 700; refer if only one is met; otherwise reject.

Black-Box Test TechniquesMedium
Save to ▾
Show answer
Conditions R1 R2 R3 R4 Salary >= 30000 T T F F Score >= 700 T F T F Actions Approve X - - - Refer to officer - X X - Reject - - - X Two Boolean conditions give 2 x 2 = 4 rules, so 4 test cases give 100 percent decision table coverage.
34

What is statement testing and how is statement coverage calculated?

White-Box, Experience and Collaboration-Based TestingEasy
Save to ▾
Show answer
Statement testing designs tests that execute the executable statements in the code. Statement coverage = statements executed by the tests / total executable statements x 100. Reaching 100 percent means every executable statement ran at least once, so a defect in any statement may be triggered. However, it does not guarantee that all decision logic is tested, for example the false outcome of an if without an else.
35

What is the value of white-box testing?

White-Box, Experience and Collaboration-Based TestingMedium
Save to ▾
Show answer
White-box testing considers the whole implementation, so it can find defects even when the specification is vague, outdated or incomplete. Coverage gives an objective measure of thoroughness. It can also be used in static testing, for example dry runs of code or pseudocode. Its main weakness is that it cannot detect omissions: if a requirement was never implemented, no white-box test will notice it.
36

Compare the four review types in CTFL v4.0.

Static TestingMedium
Save to ▾
Show answer
An informal review has no defined process or formal output and aims to detect anomalies. A walkthrough is led by the author and aims to educate, build consensus, generate ideas and detect anomalies. A technical review is done by technically qualified reviewers led by a moderator, aiming at consensus and technical decisions. An inspection is the most formal, follows the full process, collects metrics and aims to find the maximum number of anomalies.
37

In a review, what is the difference between an anomaly and a defect?

Static TestingMedium
Save to ▾
Show answer
Reviewers log anomalies: observations that differ from what they expected. Not every anomaly is a defect; some turn out to be misunderstandings, open questions or improvement suggestions. During communication and analysis the team decides each anomaly's status, owner and required action, and confirmed ones become defects for the author to fix. This keeps reviews constructive instead of treating every comment as the author's mistake.
38

What are the risks of test automation?

Test Tools and Exam PreparationMedium
Save to ▾
Show answer
Unrealistic expectations about what a tool can do; inaccurate estimates of the time, cost and effort to introduce and maintain it; using a tool where manual testing is better; relying on the tool too much and ignoring critical thinking; dependency on the tool vendor, which may go out of business or retire the tool; open-source tools being abandoned; and tools not compatible with the development platform or not meeting regulations.
39

How does component integration testing differ from system integration testing?

Testing Throughout the SDLCMedium
Save to ▾
Show answer
Component integration testing focuses on interfaces between components of the same system and is usually done by developers or testers who know the architecture, often with stubs and drivers. System integration testing focuses on interfaces with other systems and external services, such as payment gateways or government APIs, and needs production-like environments. Incremental integration, top-down or bottom-up, is preferred over big-bang because it localises defects.
40

Ten automated tests fail overnight, but the cause is an expired SSL certificate in the test environment. How should this be reported?

Defect and Configuration ManagementMedium
Save to ▾
Show answer
These failures are caused by the environment, not the test object, so they should not be logged as product defects. I would raise one environment issue with the infrastructure team, mark the test results as blocked or environment failure, and re-run after the certificate is renewed. I would also suggest monitoring certificate expiry so the same false positives do not recur.

Frequently asked questions

What happens in the ISTQB online assessment round?

Most companies start with an online test: aptitude and reasoning, a few MCQs on core ISTQB concepts, and one or two short hands-on tasks. It filters a large number of applicants, so speed and accuracy both count.

How do I clear the online assessment round?

Practise under a timer: about one minute per MCQ and 15-20 minutes per hands-on task. Read every option before answering; tests often include two nearly correct choices. Use a stable internet connection, keep your camera on and avoid switching tabs in proctored tests.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Telephonic Interview questionsTechnical Round questionsManagerial Round questionsRapid-Fire questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise ISTQB questionsExperience-wise ISTQB questionsRole-wise ISTQB questionsCity-wise ISTQB questionsMost asked ISTQB questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsISTQB mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsISTQB topic sheets