ISTQB Rapid-Fire Questions &amp; Answers

Show answer

In the whole team approach, any team member with the right knowledge can perform any task, and everyone is responsible for quality. The team shares a physical or virtual workspace, and testers work closely with business representatives to create acceptance tests and with developers to agree the test strategy and automation. It improves communication and uses combined skills, although safety-critical contexts may still need higher test independence.

What does a test plan contain according to CTFL v4.0?

Show answer

A test plan typically covers: context of testing (scope, objectives, constraints, test basis); assumptions and constraints; stakeholders with roles and responsibilities; communication; a risk register of product and project risks; the test approach (test levels, types, techniques, deliverables, entry and exit criteria, independence, metrics, test data and environments); and budget and schedule. It documents how test objectives will be met and is updated as the project changes.

How does a tester contribute to release and iteration planning?

Managing the Test ActivitiesMedium

Show answer

In release planning, testers help write testable user stories and acceptance criteria, take part in product and quality risk analyses, estimate test effort for stories, define the test approach and plan release testing. In iteration planning, they join detailed risk analysis of stories, check testability, break stories into testing tasks, estimate testing effort and identify the functional and non-functional aspects to test.

Name the main test activities in the ISTQB test process.

White-Box, Experience and Collaboration-Based TestingEasy

Show answer

The test process has seven activity groups: test planning, test monitoring and control, test analysis, test design, test implementation, test execution and test completion. They are often iterative or done in parallel rather than strictly sequential. How they are carried out depends on context, such as the SDLC, product risks, budget, time, team skills and regulations, so an Agile team performs them in small loops in every iteration.

What is error guessing?

Show answer

Error guessing anticipates errors, defects and failures based on the tester's knowledge: how the application worked before, the types of mistakes developers tend to make, and failures seen in similar applications. A methodical form is the fault attack: list possible errors, defects and failures, then design tests to expose them. Examples include division by zero, empty inputs, very long strings, special characters and wrong date formats.

Which good testing practices apply regardless of the SDLC model?

Testing Throughout the SDLCMedium

Show answer

CTFL v4.0 lists these: for every software development activity there is a corresponding test activity; each test level has its own specific objectives; test analysis and design for a level begin during the corresponding development phase; and testers are involved in reviewing work products as soon as drafts are available. Together these practices support early testing and quality control in waterfall, V-model and Agile projects alike.

What is the difference between confirmation testing and regression testing?

Show answer

Confirmation testing checks that an original defect has been fixed, by re-running the failed tests or new tests that cover the change. Regression testing checks that a change, including a fix, has not caused adverse effects elsewhere, in the same component, connected components or the environment. Regression suites grow and run often, so they are strong candidates for automation, typically inside a CI pipeline.

What are the benefits of test automation?

Test Tools and Exam PreparationMedium

Show answer

Automation saves time by reducing repetitive manual work such as regression runs, comparisons and data entry. It prevents simple human errors through greater consistency and repeatability. It gives more objective assessment, such as coverage, and access to measurements too complex for humans. It reduces test execution times, giving faster feedback and earlier defect detection, and frees testers to design new and deeper tests.

What is the format of the ISTQB CTFL v4.0 exam?

Show answer

The exam has 40 multiple-choice questions, each worth one point. The duration is 60 minutes, and candidates taking it in a non-native language usually get 25 percent extra time, making 75 minutes. The pass mark is 65 percent, which means 26 correct answers. There is no negative marking. Questions are mapped to learning objectives at K1, K2 and K3 levels.

What are the main forms of acceptance testing?

Show answer

User acceptance testing is done by intended users. Operational acceptance testing is done by operations staff and covers backup, restore, installation and disaster recovery. Contractual and regulatory acceptance testing checks contract criteria or legal rules. Alpha testing is done by potential users at the developer's site, and beta testing by users at their own locations. Acceptance testing mainly builds confidence and validates fitness, not defect finding.

Describe a typical defect life cycle.

White-Box, Experience and Collaboration-Based TestingEasy

Show answer

A defect is logged as new or open, then triaged: it may be rejected, marked duplicate or deferred, or assigned for fixing. After the developer fixes it, it moves to awaiting confirmation testing. The tester re-tests; if it passes, the defect is closed, and if it fails, it is re-opened. Teams customise the workflow, but each status should have clear rules about who can move it and when.

What is exploratory testing and when is it most useful?

Show answer

In exploratory testing, tests are designed, executed and evaluated at the same time while the tester learns about the test object. It is often structured as session-based testing with a time box, a test charter and a debrief. It is most useful when specifications are few or poor, under time pressure, or to complement formal techniques. Its success depends on the tester's experience, domain knowledge, curiosity and analytical skills.

What information does a defect report typically contain in CTFL v4.0?

Show answer

A unique identifier; a title with a short summary; date observed, issuing organisation and author; the test object and test environment; context such as test case, test activity and test data; a description for reproduction with steps, logs, screenshots, and expected and actual results; severity; priority; status such as open, deferred, duplicate, re-opened, closed or rejected; and references, for example to the test case.

Are there prerequisites for CTFL, and does the certificate expire?

Show answer

There are no formal prerequisites for the Foundation Level exam; students, freshers and experienced professionals can all take it, although some practical testing exposure makes the syllabus easier. The CTFL certificate has lifetime validity and does not need renewal. It is the prerequisite for ISTQB Advanced Level and most Specialist certifications, so it is the starting point of the ISTQB path.

What is the difference between verification and validation?

Show answer

Verification checks whether the system meets its specified requirements: 'Are we building the product right?' Validation checks whether the system meets user and stakeholder needs in its operational environment: 'Are we building the right product?' Both are testing objectives. Example: verification confirms the eight-character password rule is implemented, while validation checks that real users can actually register easily on a mobile phone.

Why is early and frequent stakeholder feedback important?

Show answer

Early and frequent feedback catches misunderstandings about requirements before they become expensive. Without it, the product may not match what stakeholders want, leading to costly rework, missed deadlines, blame games and even project failure. Regular feedback through reviews, demos and backlog refinement keeps the team focused on the most valuable features and builds a shared understanding of what is being built.

What is risk, and how do project risks differ from product risks?

Show answer

A risk is a potential event or condition whose occurrence causes an adverse effect. Risk level is determined by likelihood and impact. Project risks affect the management and control of the project, such as staff shortages, delays, budget cuts, vendor problems or tool issues. Product risks relate to quality characteristics of the product, such as missing functionality, wrong calculations, slow response, poor security or bad usability.

What is the test pyramid?

Show answer

The test pyramid shows that tests have different granularity and that a healthy suite has many small, fast, isolated tests at the bottom, such as unit or component tests, and fewer large, slow, complex end-to-end tests at the top, such as UI tests. Middle layers often cover API or integration tests. The pyramid helps teams plan automation so the suite is fast, stable and cheap to maintain.

What are entry and exit criteria? How do they relate to Definition of Ready and Definition of Done?

Show answer

Entry criteria define preconditions for starting an activity, such as available resources, testware, a stable build and a test environment. Exit criteria define what must be achieved to finish, such as coverage reached, unresolved defect counts, defect density and passed tests. Running out of time or budget can also be a valid exit. In Agile, exit criteria are often called the Definition of Done and entry criteria for a story the Definition of Ready.

What are the objectives of a defect report?

Show answer

A defect report gives the people responsible for handling and resolving the defect enough information to fix it. It also provides a way to track the quality of the work product, and it offers ideas for improving the development and test processes. A good report is clear, reproducible and neutral in tone, so that developers can act on it quickly and managers can analyse trends.

What are the five test levels in CTFL v4.0?

Show answer

Component testing checks individual units in isolation. Component integration testing checks interfaces and interactions between components. System testing checks overall behaviour, both functional and non-functional. System integration testing checks interfaces with other systems and external services. Acceptance testing focuses on validation and readiness for deployment. Each level has its own objectives, test basis, test objects, typical defects and responsibilities.

What does 'defects cluster together' mean and how is it used?

Show answer

A small number of components usually contain most of the defects or cause most operational failures, similar to the Pareto principle. Predicted and observed defect clusters are an important input to risk-based testing, so testers focus more effort on those areas. Example: in a banking app, the interest calculation and payment modules may hold most reported defects, so they get deeper and more frequent regression coverage.

Which work products can be examined by static testing?

White-Box, Experience and Collaboration-Based TestingEasy

Show answer

Almost any work product that can be read and understood: requirements, user stories, acceptance criteria, architecture and design documents, source code, test plans, test cases, test charters, backlog items, contracts, project plans, schedules and budgets. Static analysis tools need work products with a formal structure, such as code or models with defined syntax. Products that are hard for humans to interpret, like third-party executable code, are not suitable for review.

What is statement testing and how is statement coverage calculated?

Show answer

Statement testing designs tests that execute the executable statements in the code. Statement coverage = statements executed by the tests / total executable statements x 100. Reaching 100 percent means every executable statement ran at least once, so a defect in any statement may be triggered. However, it does not guarantee that all decision logic is tested, for example the false outcome of an if without an else.

Why does 100 percent branch coverage guarantee 100 percent statement coverage, but not the other way round?

White-Box, Experience and Collaboration-Based TestingMedium

Show answer

Every statement lies on at least one branch, so exercising all branches executes all statements. The reverse fails when a decision has an empty outcome. Example: 'if x > 10: print(big)' followed by 'print(done)'. One test with x = 15 runs every statement, giving 100 percent statement coverage, but the false branch is never taken, so branch coverage is only 50 percent. This is called subsumption.

Explain error, defect, failure and root cause with an example.

Show answer

A human makes an error (mistake), for example misreading a requirement. The error produces a defect (fault or bug) in a work product such as code or a document. When defective code is executed it may cause a failure, meaning the system does something wrong or fails to do something. The root cause is the fundamental reason for the error, such as time pressure or unclear requirements. Failures can also come from environmental conditions like radiation.

What types of defects are typically found by static testing?

Static TestingMedium

Show answer

Requirements defects such as inconsistencies, ambiguities, contradictions, omissions and duplicates; design defects like inefficient database structures or poor modularisation; coding defects such as variables with undefined values, unreachable or duplicated code and excessive complexity; deviations from standards; incorrect interface specifications; security vulnerabilities like buffer overflows; and gaps in test coverage, such as missing tests for an acceptance criterion.

Compare TDD, ATDD and BDD.

Testing Throughout the SDLCMedium

Show answer

All three are test-first approaches. In TDD, developers write a failing unit test, write code to pass it, then refactor. In ATDD, acceptance tests are derived from acceptance criteria with the team and business before development starts. In BDD, desired behaviour is written as Given/When/Then scenarios in natural language that stakeholders understand and that can be turned into executable tests. All three support shift-left.

What is the difference between 2-value and 3-value boundary value analysis?

Black-Box Test TechniquesMedium

Show answer

BVA applies to ordered partitions. In 2-value BVA each boundary has two coverage items: the boundary value and its closest neighbour in the adjacent partition. In 3-value BVA there are three: the boundary and both neighbours. For a valid range 18 to 60, 2-value gives 17, 18, 60, 61, and 3-value gives 17, 18, 19, 59, 60, 61. 3-value is stricter and can catch defects like 'x == 18' written instead of 'x >= 18'.

What is the difference between severity and priority?

Show answer

Severity is the degree of impact the defect has on the system or its stakeholders, such as a crash or data loss. Priority is the urgency of fixing it, usually set by the business or product owner. Testers usually suggest severity, and priority is decided in triage. Example: a crash in a rarely used admin report is high severity but may be low priority.

How does component integration testing differ from system integration testing?

Testing Throughout the SDLCMedium

Show answer

Component integration testing focuses on interfaces between components of the same system and is usually done by developers or testers who know the architecture, often with stubs and drivers. System integration testing focuses on interfaces with other systems and external services, such as payment gateways or government APIs, and needs production-like environments. Incremental integration, top-down or bottom-up, is preferred over big-bang because it localises defects.

What is static testing and how is it different from dynamic testing?

Show answer

Static testing examines work products without executing them, through manual reviews or static analysis tools. Dynamic testing executes the software. Static testing finds defects directly, such as ambiguous requirements or coding standard violations, while dynamic testing causes failures whose defects are then located by debugging. Static testing works on non-executable products like requirements and test plans, and finds defects dynamic testing cannot, such as unreachable code.

Which test estimation techniques are described in CTFL v4.0?

Managing the Test ActivitiesMedium

Show answer

Estimation based on ratios uses historical figures, such as a development-to-test effort ratio. Extrapolation uses measurements from the current project, for example averaging the last three iterations. Wideband Delphi is an expert-based technique where experts estimate separately and iterate until consensus; Planning Poker is an Agile variant. Three-point estimation uses optimistic, most likely and pessimistic values to calculate a weighted estimate and its standard deviation.

How does the choice of SDLC model affect testing?

White-Box, Experience and Collaboration-Based TestingEasy

Show answer

In sequential models like waterfall and the V-model, testers join early for reviews and planning, but dynamic testing happens later once code exists. In iterative and incremental models such as Scrum, every iteration delivers a working increment, so static and dynamic testing happen at all levels in each iteration, regression testing is critical and automation is usually needed. The model affects scope, timing, documentation, techniques and automation.

Explain equivalence partitioning and its coverage.

Black-Box Test TechniquesEasy

Show answer

Equivalence partitioning divides data into partitions whose values are expected to be processed the same way, so one value per partition is enough. Partitions can cover inputs, outputs, configuration items or time, and include valid and invalid partitions. They must be non-empty and must not overlap. Coverage is partitions exercised divided by partitions identified. With several inputs, Each Choice coverage requires every partition of every input to be used at least once.

How is test analysis different from test design?

Fundamentals of TestingMedium

Show answer

Test analysis answers 'what to test': it analyses the test basis, identifies testable features, defines and prioritises test conditions, and evaluates the test basis for defects. Test design answers 'how to test': it turns test conditions into test cases, identifies coverage items, defines test data requirements and designs the test environment. Example: the condition 'login with a locked account' becomes, in design, a case with exact inputs and the expected error message.

What is checklist-based testing and what are its risks?

Show answer

In checklist-based testing, the tester designs and runs tests to cover the conditions on a checklist built from experience, user needs or knowledge of why software fails. Items should be specific and testable, not vague or automatable by tools. Checklists give some consistency and guidance when detailed test cases are missing, but they become less effective over time as developers learn to avoid those mistakes, so they must be updated regularly.

What are false positives and false negatives in testing?

Defect and Configuration ManagementMedium

Show answer

A false positive is a test result that reports a defect when none exists, for example a test failing because of wrong test data or an unstable environment. A false negative is a test that passes even though a defect is present, so the defect is missed. False positives waste time and reduce trust in tests; false negatives are more dangerous because defects escape to production.

What does the principle 'tests wear out' mean, and what was it called earlier?

Fundamentals of TestingMedium

Show answer

In v4.0 the old 'pesticide paradox' was renamed 'tests wear out'. If the same tests are repeated many times, they become less effective at finding new defects because the code they exercise has already been fixed. Testers should modify existing tests and test data and write new tests. The exception is automated regression testing, where repeating the same tests is valuable because the goal is to confirm nothing has broken.

What categories of test tools does CTFL v4.0 describe?

Show answer

Test management tools, static testing tools, test design and implementation tools, test execution and coverage tools, non-functional testing tools, DevOps tools such as CI/CD pipelines and build tools, collaboration tools, and tools supporting scalability and deployment standardisation such as virtual machines and containers. Any tool that assists testing counts, even a spreadsheet. Tools improve efficiency, quality and repeatability.

Compare the four review types in CTFL v4.0.

Static TestingMedium

Show answer

An informal review has no defined process or formal output and aims to detect anomalies. A walkthrough is led by the author and aims to educate, build consensus, generate ideas and detect anomalies. A technical review is done by technically qualified reviewers led by a moderator, aiming at consensus and technical decisions. An inspection is the most formal, follows the full process, collects metrics and aims to find the maximum number of anomalies.

What are the typical objectives of testing according to the ISTQB CTFL v4.0 syllabus?

Show answer

Testing objectives include evaluating work products such as requirements and code, triggering failures and finding defects, ensuring required coverage of the test object, reducing the risk of poor quality, verifying that specified requirements are met, checking compliance with contracts or regulations, giving stakeholders information for decisions, building confidence in quality, and validating that the test object works as users expect. Objectives vary with context, test level and the SDLC model.

How do retrospectives help testing?

Show answer

A retrospective is held at the end of an iteration, release or project to discuss what went well, what did not and how to improve. For testing, the benefits include more effective and efficient testing, better testware, team bonding, better quality of the test basis and stronger cooperation between developers and testers. Results should be recorded and the improvement actions tracked so that they are actually carried out.

Which black-box test techniques are covered in CTFL v4.0?

Black-Box Test TechniquesEasy

Show answer

CTFL v4.0 covers four black-box techniques: equivalence partitioning, boundary value analysis (2-value and 3-value), decision table testing and state transition testing. They derive tests from the specification without looking at the internal structure, so tests stay valid even when the implementation changes. Use case testing, which was in older syllabi, is no longer part of the v4.0 Foundation syllabus.

How are CTFL v4.0 exam questions distributed across chapters?

Test Tools and Exam PreparationMedium

Show answer

Approximately: Chapter 1, Fundamentals of Testing, 8 questions; Chapter 2, Testing Throughout the SDLC, 6; Chapter 3, Static Testing, 4; Chapter 4, Test Analysis and Design, 11; Chapter 5, Managing the Test Activities, 9; Chapter 6, Test Tools, 2. Chapters 4 and 5 carry half the marks and include most K3 questions, so practise techniques and estimation thoroughly.

What are the roles in a formal review?

Show answer

The manager decides what is reviewed and provides resources. The author creates and fixes the work product. The moderator, or facilitator, ensures meetings run effectively, mediating and managing time. The scribe, or recorder, collects anomalies and records decisions. Reviewers perform the review and may be team members, experts or stakeholders. The review leader takes overall responsibility, deciding who is involved and organising the review. One person can hold several roles.

List the seven testing principles in CTFL v4.0.

Show answer

1) Testing shows the presence, not the absence, of defects. 2) Exhaustive testing is impossible, so use test techniques, prioritisation and risk. 3) Early testing saves time and money. 4) Defects cluster together in a few components. 5) Tests wear out, so update them or write new ones. 6) Testing is context dependent. 7) Absence-of-defects fallacy: a defect-free system can still fail if it does not meet user needs.

What is the shift-left approach in testing?

Show answer

Shift-left means performing testing earlier in the SDLC. Practices include reviewing specifications from a tester's perspective, writing test cases before code, using CI/CD for fast feedback, running static analysis before dynamic testing and starting non-functional testing at component level. It costs extra effort early, but saves much more later, because a defect found in requirements is far cheaper to fix than one found in production.

What do the K-levels K1, K2 and K3 mean in the CTFL syllabus?