ISTQB Foundation Level Sample Paper 3 (CTFL v4.0, 40 Questions with Answers)

The whole team approach is a practice that comes from which development method?

1. A. Waterfall
2. B. Kanban
3. C. Extreme Programming (XP)
4. D. The V-model

How are test results used in quality assurance?

1. A. As feedback on how well the development and test processes are performing
2. B. To fix individual defects in the code
3. C. To decide the price of the product
4. D. They are not used in QA at all

After a developer fixes a defect, who should preferably perform the confirmation testing?

1. A. The developer who fixed the defect
2. B. The product owner
3. C. Any automated tool, never a person
4. D. The person who performed the test that originally found the failure

Why might testing be required on a medical device software project, beyond finding defects?

1. A. To decide the marketing strategy
2. B. To comply with regulatory standards and legal requirements
3. C. To replace the development team’s code reviews
4. D. To reduce the number of user stories

A satellite’s software fails because radiation changes bits in its firmware memory. Which statement is correct?

1. A. The failure was caused by a human error in the code
2. B. The failure is a root cause
3. C. Failures can also be caused by environmental conditions, as in this case
4. D. This cannot be a failure because no defect was coded

A form has 12 fields, each accepting 10 different values. A manager asks the team to test every combination before release. Which principle explains why this is not feasible?

1. A. Exhaustive testing is impossible
2. B. Tests wear out
3. C. Defects cluster together
4. D. Testing is context dependent

Which task belongs to test completion?

1. A. Defining and prioritising test conditions
2. B. Comparing actual results with expected results
3. C. Building and verifying the test environment
4. D. Archiving testware that may be useful in future, and creating change requests for unresolved defects

Which arrangement gives the HIGHEST level of test independence?

1. A. The author tests their own code
2. B. Testers from outside the organisation test the work product
3. C. A peer from the same team tests the code
4. D. Testers from another team inside the organisation test it

Which statement is true for TDD, ATDD and BDD?

1. A. Tests are written after the code is complete
2. B. Tests are defined before the code is written, applying early testing and shift left
3. C. They can only be used in sequential development models
4. D. They do not produce tests that can be automated

When should test analysis and design for a given test level begin?

1. A. After the test level’s code is released to production
2. B. Only when the test environment is ready
3. C. After all other test levels are complete
4. D. During the corresponding development phase of the SDLC

In iterative and incremental development where increments are delivered frequently, what does testing need most?

1. A. Fast feedback and extensive regression testing
2. B. One large test phase at the end of the project
3. C. No static testing
4. D. Testing only at the acceptance level

Before go-live, a bank’s operations team tests backup, restore and disaster recovery procedures. Which form of acceptance testing is this?

1. A. User acceptance testing
2. B. Contractual acceptance testing
3. C. Operational acceptance testing
4. D. Beta testing

Which of the following is a non-functional quality characteristic listed in the syllabus (based on ISO/IEC 25010)?

1. A. Functional correctness
2. B. Portability (also known as flexibility)
3. C. Functional completeness
4. D. Decision coverage

Which factor typically determines the scope of maintenance testing?

1. A. The number of testers on the team
2. B. The programming language used
3. C. The colour scheme of the user interface
4. D. The degree of risk of the change

What do work products need in order to be examined by static analysis tools?

1. A. A structure against which they can be checked, such as models, code or text with a formal syntax
2. B. An executable build
3. C. A signed contract
4. D. A completed test execution schedule

Which review role decides who will be involved and organises when and where the review takes place?

1. A. Manager
2. B. Moderator
3. C. Review leader
4. D. Scribe

Which defect is typically easier or cheaper to find through static testing than through dynamic testing?

1. A. A slow response under peak load
2. B. A crash that appears after hours of continuous use
3. C. A wrong result that only appears in production data
4. D. A mismatch in the number, type or order of parameters in an interface specification

Which statement about inspections is correct?

1. A. They are led by the author
2. B. The author cannot act as the review leader or the scribe, and metrics are collected to improve the process
3. C. They do not follow a defined process
4. D. Their only objective is to educate the reviewers

For which family of test techniques do test cases remain useful when the implementation changes but the required behaviour stays the same?

1. A. Black-box test techniques
2. B. White-box test techniques
3. C. Code-coverage-based techniques
4. D. None of them

A username must be 6 to 12 characters long and contain letters only. A tester identifies five partitions: length below 6, length 6 to 12, length above 12, letters only, and contains non-letters. The tests are “abc”, “abcdefgh” and “abcd1234”. What equivalence partitioning coverage do they achieve?

1. A. 60%
2. B. 100%
3. C. 80%
4. D. 40%

Parcel weights are entered in steps of 0.1 kg. 0.0 kg or less is invalid, 0.1 to 5.0 kg is standard, 5.1 to 20.0 kg is heavy, and above 20.0 kg is rejected. How many test values are needed for 100% 2-value boundary value coverage?

1. A. 4
2. B. 6
3. C. 8
4. D. 12

A discount rule has two conditions: “customer is a senior citizen” and “customer is a student”. A customer cannot be both, so that combination is infeasible. How many test cases are needed for 100% decision table coverage of the full table?

1. A. 4
2. B. 2
3. C. 1
4. D. 3

A state table has 3 states and 3 events, and 5 of its cells are valid transitions. Two test cases exercise all 5 valid transitions and attempt 2 invalid transitions. What all transitions coverage do they achieve?

1. A. About 77.8%
2. B. About 55.6%
3. C. 100%
4. D. About 71.4%

Which of the following is a conditional branch?

1. A. Straight-line code between two statements
2. B. The decision to exit or continue a loop
3. C. A comment in the source code
4. D. A function’s name

Why do white-box coverage measures add value beyond black-box testing alone?

1. A. They make black-box testing unnecessary
2. B. They detect requirements that were never implemented
3. C. They give an objective measure of code coverage and show where more tests are needed
4. D. They remove the need for test design

What are fault attacks?

1. A. A structured way to perform error guessing, using a list of possible errors, defects and failures
2. B. Security attacks run by external hackers
3. C. A type of static analysis tool
4. D. A review type led by the author

Why should checklists used in checklist-based testing be updated regularly?

1. A. Because checklists must contain every possible test
2. B. Because longer checklists are always better
3. C. Because checklists must include items that tools can check automatically
4. D. Because items lose effectiveness as developers learn to avoid those errors, and new high-severity defects may need new entries

In the “3 C’s” of user stories, what is the Confirmation?

1. A. The card or electronic board entry
2. B. The acceptance criteria
3. C. The conversation about how the software will be used
4. D. The developer’s code review

User story: “As a shopper, I want free delivery on orders of ₹499 or more.” Acceptance criteria: (1) orders of ₹499 or more get free delivery; (2) orders below ₹499 pay a ₹49 delivery fee. Which pair of ATDD test cases covers both criteria without duplication?

1. A. A ₹600 order gets free delivery; a ₹700 order gets free delivery
2. B. A ₹100 order pays ₹49; a ₹200 order pays ₹49
3. C. A ₹499 order gets free delivery; a ₹498 order pays ₹49
4. D. A ₹499 order on the website gets free delivery; a ₹499 order on Android gets free delivery

Which two factors determine the risk level?

1. A. Test coverage and defect density
2. B. Budget and schedule
3. C. Number of testers and number of test cases
4. D. Risk likelihood and risk impact

When can running out of time or budget be an acceptable reason to stop testing?

1. A. When stakeholders have reviewed and accepted the risk of going live without further testing
2. B. Never; all exit criteria must always be met
3. C. Only if no defects have been found
4. D. Only in sequential development models

Three-point estimates for a test task are: optimistic a = 6, most likely m = 12 and pessimistic b = 30 hours. What are the estimate E and the standard deviation SD?

1. A. E = 12, SD = 4
2. B. E = 16, SD = 6
3. C. E = 14, SD = 4
4. D. E = 14, SD = 24

Requirement priorities are: R-A high, R-B medium, R-C low. Test T1 covers R-C, T2 covers R-A, T3 covers R-B, and T4 covers R-A but needs data created by T1. Using requirements-based prioritization, which order is correct?

1. A. T2, T4, T1, T3
2. B. T2, T1, T4, T3
3. C. T2, T3, T1, T4
4. D. T1, T2, T3, T4

Which tests belong to testing quadrant Q2 (business facing, supporting the team)?

1. A. Component tests run in CI
2. B. Smoke tests and performance tests
3. C. Exploratory and usability testing
4. D. Functional tests, examples, user story tests and API tests

Which is a possible consequence when a PRODUCT risk occurs?

1. A. The project schedule is delayed
2. B. User dissatisfaction and loss of reputation
3. C. The budget is overrun
4. D. The project scope is reduced

What is the main purpose of a test progress report?

1. A. To support ongoing test control with enough information to adjust the schedule, resources or plan
2. B. To archive testware at the end of the project
3. C. To replace the test plan
4. D. To list lessons learned after the release

How does configuration management make it possible to reproduce earlier test results?

1. A. By deleting old versions of test items
2. B. By assigning priorities to defects
3. C. By recording changed configuration items for each baseline, so a previous baseline can be restored
4. D. By running all regression tests automatically

The company name is misspelled on the home page of a banking website. Nothing else is affected. Which classification is most appropriate in the defect report?

1. A. High severity, low priority
2. B. High severity, high priority
3. C. Low severity, low priority
4. D. Low severity, high priority

The team uses containers so that every tester gets an identical test environment. Which type of tool is this?

1. A. Test design and implementation tool
2. B. Static testing tool
3. C. Tool supporting scalability and deployment standardisation
4. D. Test management tool

A team wants to automate a one-off exploratory usability check of a new screen. Which risk of test automation does this illustrate?

1. A. Using a test tool when manual testing is more appropriate
2. B. Reduced test execution time
3. C. Easier access to information about testing
4. D. Prevention of simple human errors