ISTQB Foundation Level Sample Paper 1 (CTFL v4.0, 40 Questions with Answers)

Which of the following is a typical test objective?

1. A. Verifying whether specified requirements have been fulfilled
2. B. Fixing the defects found during component testing
3. C. Guaranteeing that the software contains no defects
4. D. Writing the source code for new features

Under time pressure, a product owner writes an acceptance criterion with the wrong currency. A developer implements it, and customers in production see prices in USD instead of INR. What is the defect?

1. A. The time pressure on the product owner
2. B. The product owner’s mistake while writing
3. C. The wrong currency in the acceptance criterion (and later in the code)
4. D. Customers seeing prices in USD

After 300 test cases pass, a manager announces that the release is defect-free. Which testing principle does this statement ignore?

1. A. Defects cluster together
2. B. Testing shows the presence, not the absence, of defects
3. C. Tests wear out
4. D. Early testing saves time and money

Which statement about testing and debugging is correct?

1. A. Debugging is a test activity normally done by testers
2. B. Testing can trigger failures, while debugging finds, analyses and removes their causes
3. C. Debugging must reproduce and diagnose defects found in reviews
4. D. Confirmation testing is part of debugging

In which test activity is the test environment built and verified to be set up correctly?

1. A. Test planning
2. B. Test analysis
3. C. Test design
4. D. Test implementation

Which work products are typically created during test design?

1. A. Test logs and defect reports
2. B. Risk register and test schedule
3. C. Test cases, test charters, coverage items and test data requirements
4. D. Test completion report and lessons learned

Which is an advantage of the whole team approach?

1. A. Improved communication and collaboration within the team
2. B. Testers work separately to stay independent of developers
3. C. Only testers are responsible for quality
4. D. It is always required for safety-critical systems

Which of the following is a benefit of independent testing?

1. A. Developers may lose their sense of responsibility for quality
2. B. Independent testers may be seen as a bottleneck
3. C. Independent testers may be isolated from the development team
4. D. Independent testers are likely to recognise different kinds of failures because of their different backgrounds

In which approach are tests written first, then code is written to pass them, and then both are refactored?

1. A. Test-driven development (TDD)
2. B. Behaviour-driven development (BDD)
3. C. Exploratory testing
4. D. Maintenance testing

Which good testing practice applies to every software development lifecycle?

1. A. Dynamic testing starts only after all code is complete
2. B. All test levels share the same test objectives
3. C. Testers review work products as soon as drafts are available
4. D. Test analysis begins after the product is released

Which statement about shift left is correct?

1. A. It means testing in later phases can be skipped
2. B. It may need more effort and cost early but is expected to save effort and cost later
3. C. It applies only to sequential development models
4. D. It means that only developers perform testing

Developers test that the newly built login component passes the correct user ID to the user-profile component. Which test level is this?

1. A. System testing
2. B. Acceptance testing
3. C. Component testing
4. D. Component integration testing

After a defect fix, a tester reruns the test that originally failed, and it passes. The team then reruns a suite of tests on unchanged areas of the system. How are these two activities named?

1. A. The first is confirmation testing; the second is regression testing
2. B. The first is regression testing; the second is confirmation testing
3. C. Both are confirmation testing
4. D. Both are regression testing

Which of the following is a trigger for maintenance testing?

1. A. Writing the first user stories for a new product
2. B. Component testing of a new feature before its first release
3. C. Migrating the operational system to a new cloud platform
4. D. Holding a specification workshop for a new story

In a review, who collates anomalies from the reviewers and records decisions made in the review meeting?

1. A. Moderator
2. B. Scribe
3. C. Review leader
4. D. Author

Which factor contributes to a successful review?

1. A. Reviewing a 200-page document in a single session
2. B. Using the review to evaluate the author’s performance
3. C. Skipping training because reviews are simple
4. D. Giving participants adequate time to prepare

Which statement describes a difference between static testing and dynamic testing?

1. A. Static testing can be applied to non-executable work products; dynamic testing cannot
2. B. Static testing causes failures; dynamic testing finds defects directly
3. C. Only dynamic testing can find defects in requirements
4. D. Static testing can measure performance efficiency

A review is led by a moderator, uses technically qualified reviewers, and its main goal is to reach a decision on a technical problem. Which review type is this?

1. A. Informal review
2. B. Walkthrough
3. C. Technical review
4. D. Inspection

Which family of test techniques relies mainly on the tester’s knowledge, and can find defects that the other techniques miss?

1. A. Black-box test techniques
2. B. White-box test techniques
3. C. Collaboration-based approaches
4. D. Experience-based test techniques

A car insurance quote uses the driver’s age in whole years: under 18 is rejected, 18 to 25 pays a high premium, 26 to 60 pays the standard premium, 61 to 75 pays a senior premium, and over 75 needs a medical check. Tests use the ages 17, 30, 65 and 80. What equivalence partitioning coverage do they achieve?

1. A. 60%
2. B. 80%
3. C. 100%
4. D. 40%

A discount applies to orders from ₹500 to ₹2,000 inclusive (whole rupees). Using 2-value boundary value analysis, which set of values achieves 100% coverage?

1. A. 500, 2000
2. B. 499, 500, 501, 1999, 2000, 2001
3. C. 499, 500, 2000, 2001
4. D. 0, 499, 2001, 9999

A minimised decision table for opening a bank account has four rules. R1: ID invalid → reject (other conditions irrelevant). R2: ID valid, age under 18 → reject. R3: ID valid, 18 or over, no address proof → reject. R4: ID valid, 18 or over, address proof → open account. The tests are T1 (invalid ID, age 30, with proof), T2 (valid ID, age 16, with proof) and T3 (valid ID, age 16, without proof). What decision table coverage do they achieve?

1. A. 50%
2. B. 25%
3. C. 75%
4. D. 100%

A media player has the states Stopped, Playing and Paused, with five valid transitions: Stopped -play→ Playing, Playing -pause→ Paused, Paused -play→ Playing, Playing -stop→ Stopped and Paused -stop→ Stopped. Every test case starts in Stopped. What is the minimum number of test cases for 100% valid transitions coverage?

1. A. 5
2. B. 3
3. C. 2
4. D. 1

What does 100% statement coverage guarantee?

1. A. All decision outcomes have been exercised
2. B. All defects in the code have been found
3. C. Every executable statement has been executed at least once
4. D. All paths through the code have been tested

Which is a strength of white-box testing?

1. A. It reliably finds requirements that were never implemented
2. B. It considers the entire implementation, so it can find defects even when the specification is vague or outdated
3. C. It can be used without any access to the code or design
4. D. It can only be applied after the system is released

In which situation is exploratory testing especially useful?

1. A. Complete formal specifications and plenty of time are available
2. B. A regulator requires detailed, pre-scripted test documentation
3. C. Specifications are few or inadequate and there is significant time pressure
4. D. Only automated regression testing is needed

Which item is most appropriate for a checklist used in checklist-based testing?

1. A. “Is the software good?”
2. B. “Has 80% code coverage been reached?”
3. C. “Do all unit tests pass in the CI pipeline?”
4. D. “Is every mandatory field marked with an asterisk?”

Which acceptance criterion is written in a rule-oriented format?

1. A. Given a registered user, When they enter a wrong password three times, Then the account is locked
2. B. • Password length is 8 to 16 characters • It must contain at least one digit • It must not equal the username
3. C. As a user, I want to reset my password, so that I can regain access
4. D. Explore the login page with unusual inputs for 30 minutes

User story: “As a member, I want to reset my password with an emailed link that is valid for 30 minutes.” Using ATDD, which test case should the team write FIRST?

1. A. Request a reset, open the link within 30 minutes, set a new password, and log in successfully with it
2. B. Open the link after 31 minutes and check that it is rejected
3. C. Send 1,000 reset requests per minute and measure the response time
4. D. Reset the password by SMS instead of email

Which of the following is an exit criterion?

1. A. The test environment is available
2. B. Testable requirements are available
3. C. All smoke tests have passed on the new build
4. D. All planned tests have been executed and no critical defects remain open

Using three-point estimation with a = 10, m = 14 and b = 24 person-days, what is the estimated test effort E?

1. A. 14 person-days
2. B. 16 person-days
3. C. 15 person-days
4. D. 48 person-days

The team uses additional coverage prioritization. Test T1 covers requirements R1, R2 and R3; T2 covers R3 and R4; T3 covers R1 and R2; T4 covers R4 and R5. Which test is executed second?

1. A. T4
2. B. T2
3. C. T3
4. D. It cannot be determined

Which tests make up the bottom layer of the test pyramid?

1. A. A few slow end-to-end tests
2. B. Many small, isolated and fast tests
3. C. Manual exploratory sessions
4. D. User acceptance tests

Automated component tests that run in the CI pipeline belong to which testing quadrant?

1. A. Q4: technology facing, critique the product
2. B. Q3: business facing, critique the product
3. C. Q2: business facing, support the team
4. D. Q1: technology facing, support the team

Which of the following is a project risk?

1. A. The system may respond too slowly during a sale
2. B. The tax calculation may be incorrect
3. C. The only performance tester may be unavailable during the test window
4. D. The login page may contain a security vulnerability

How can the results of product risk analysis be used?

1. A. To determine the test techniques and coverage to apply in each area
2. B. To replace the need for exit criteria
3. C. To decide the developers’ salaries
4. D. To guarantee that all high risks are removed

Which information is typically included in a test progress report?

1. A. Lessons learned for future projects
2. B. Testing planned for the next reporting period
3. C. Final evaluation of product quality against the exit criteria
4. D. Defects that will not be fixed in this release

A tester reports: “ID DEF-77. Title: Wrong total after coupon. Steps: add 2 items, apply SAVE10. Expected: ₹1,800. Actual: ₹1,620. Severity: major. Priority: high. Status: open.” Which information should be added to best help the developer reproduce the failure?

1. A. The tester’s years of experience
2. B. The number of tests that passed in the suite
3. C. The project budget
4. D. The test object version and the test environment

A tool runs the automated test suite and reports which lines of code were executed. Which type of tool is it?

1. A. Test management tool
2. B. Static testing tool
3. C. Test execution and coverage tool
4. D. Collaboration tool

Which of the following is a potential risk of test automation?

1. A. More objective assessment of coverage
2. B. Dependency on the tool vendor, which may stop supporting the tool
3. C. Less repetitive manual work
4. D. Faster feedback on defects