ISTQB Foundation Level Sample Paper 2 (CTFL v4.0, 40 Questions with Answers)

Which statement about quality assurance (QA) is correct?

1. A. QA is product-oriented and focuses on finding defects
2. B. QA is process-oriented and preventive, and it is everyone’s responsibility on the project
3. C. QA is the same as testing
4. D. QA is performed only by the test manager

Which of the following is NOT a typical test objective?

1. A. Evaluating work products such as requirements and code
2. B. Providing information so stakeholders can make decisions
3. C. Ensuring the required coverage of a test object
4. D. Removing the defects that caused failures

Which of the following is an example of testing contributing to project success?

1. A. Testers write the production code for urgent features
2. B. Testers decide the product’s selling price
3. C. Testers bring the users’ perspective into the project, representing users indirectly
4. D. Testers remove defects directly from the source code

An app passes every test against its specification, but users reject it because it does not support how they actually work. Which principle does this illustrate?

1. A. Absence-of-defects fallacy
2. B. Defects cluster together
3. C. Tests wear out
4. D. Exhaustive testing is impossible

Which statement about the test process in context is correct?

1. A. The same test process should be used unchanged for every project
2. B. Factors such as business-domain criticality and project constraints influence the test strategy and the level of detail of testware
3. C. Context affects only test execution, not test planning
4. D. The available tools never influence how testing is done

What does traceability between test results and risks make possible?

1. A. Evaluating the level of residual risk in the test object
2. B. Removing the need for test planning
3. C. Automatically fixing the riskiest defects
4. D. Guaranteeing that no risks remain

In Agile software development, who may handle test management tasks?

1. A. Only a dedicated test manager outside the team
2. B. Some tasks may be handled by the Agile team itself, while tasks spanning several teams may be done by test managers outside the team
3. C. Only the product owner
4. D. Nobody, because Agile teams do not need test management

A tester reports a defect factually, focusing on the product’s behaviour and its impact rather than on the developer who wrote the code. Which skill does this show?

1. A. Domain knowledge
2. B. Technical knowledge
3. C. Good communication skills
4. D. Thoroughness

Which approach derives tests from acceptance criteria as part of the system design process, before the feature is developed?

1. A. Test-driven development (TDD)
2. B. Exploratory testing
3. C. Maintenance testing
4. D. Acceptance test-driven development (ATDD)

Why should different test levels have specific and different test objectives?

1. A. So testing is appropriately comprehensive while avoiding redundancy
2. B. So each level can be skipped if another level passes
3. C. So that all levels can use the same test cases
4. D. So that only one level needs exit criteria

In Agile software development, which practices are typically favoured?

1. A. Detailed documentation before any coding starts
2. B. No regression testing, because the code changes often
3. C. Lightweight documentation and extensive test automation for regression testing
4. D. Only scripted manual tests designed months in advance

Which is a challenge of DevOps from a testing perspective?

1. A. Faster feedback on code quality
2. B. The DevOps delivery pipeline must be defined and established
3. C. Better visibility of non-functional characteristics
4. D. Less repetitive manual testing

Which is a typical benefit of retrospectives for testing?

1. A. They replace the test completion report
2. B. They remove the need for regression testing
3. C. They guarantee that no defects reach production
4. D. They improve the quality of the test basis, as gaps in requirements can be addressed

The main objective of which test type is to cover the underlying structure of the test object to an acceptable level?

1. A. White-box testing
2. B. Black-box testing
3. C. Functional testing
4. D. Acceptance testing

Which work products can be examined by static testing?

1. A. Only source code
2. B. Only requirement specifications
3. C. Almost any work product, for example test plans, contracts and product backlog items
4. D. Only executable software

Which is a benefit of early and frequent stakeholder feedback?

1. A. It removes the need for acceptance testing
2. B. It helps prevent misunderstandings about requirements
3. C. It guarantees on-time delivery
4. D. It replaces risk analysis

In which review activity are decisions made about the status, ownership and required actions for each anomaly, typically in a review meeting?

1. A. Planning
2. B. Review initiation
3. C. Individual review
4. D. Communication and analysis

Why are overall project costs usually lower when reviews are performed, even though reviews take effort?

1. A. Less time and effort is spent fixing defects later in the project
2. B. Reviews replace the need for dynamic testing
3. C. Reviews remove the need for test planning
4. D. Reviews make developers work faster

When can test cases based on white-box test techniques be created?

1. A. Before any requirements exist
2. B. Only after the design or implementation of the test object exists
3. C. Only during acceptance testing
4. D. Only by business representatives

An app has a coupon type {FLAT, PERCENT, CASHBACK} and a sales channel {web, Android, iOS, kiosk}. What is the minimum number of test cases for 100% Each Choice coverage?

1. A. 3
2. B. 7
3. C. 4
4. D. 12

An alarm triggers when the temperature is greater than 40 (whole degrees). Using 3-value boundary value analysis, which values must be tested?

1. A. 40, 41
2. B. 39, 40, 41, 42
3. C. 39, 40, 41
4. D. 40, 41, 42

An extended-entry decision table has 12 columns. Two of them describe infeasible combinations. The tests exercise 5 of the feasible columns. What is the decision table coverage?

1. A. 41.7%
2. B. 60%
3. C. 83.3%
4. D. 50%

A traffic-light controller has the states Red, Green, Yellow and Flashing, and seven valid transitions: Red→Green, Green→Yellow and Yellow→Red (timer); Red→Flashing, Green→Flashing and Yellow→Flashing (fault); Flashing→Red (reset). One test starts in Red and applies: timer, timer, timer, fault, reset. What valid transitions coverage does it achieve?

1. A. About 71%
2. B. 100%
3. C. About 57%
4. D. About 83%

A function contains a single IF-THEN-ELSE decision and no loops. What is the minimum number of test cases for 100% branch coverage?

1. A. 1
2. B. 3
3. C. 2
4. D. 4

Which item would typically appear in a fault-attack list for an input field?

1. A. The project budget for testing
2. B. Correct input is not accepted, or a required parameter is missing
3. C. The names of the developers on the team
4. D. The release date of the product

In session-based exploratory testing, what guides the tester during the session?

1. A. A complete set of scripted test cases
2. B. The source code
3. C. The defect reports from the last release
4. D. A test charter containing test objectives

In INVEST, what does “T” stand for, and what might it mean if a stakeholder cannot say how to test a user story?

1. A. Testable; the story may not be clear enough or not valuable to them
2. B. Traceable; the story has no requirements
3. C. Timely; the story is late
4. D. Technical; only developers can test it

Which of the following is a use of acceptance criteria?

1. A. To replace the user story card
2. B. To allow accurate planning and estimation
3. C. To record the developers’ working hours
4. D. To measure code coverage

User story: “As a customer, I want to download my invoice as a PDF from the order page.” Using ATDD, which test case should NOT be written for this story?

1. A. Download the PDF from the order page and check that the totals match the order
2. B. Download the PDF for an order with 50 items and check every item is listed
3. C. Check that invoices are emailed to the customer automatically every month
4. D. Download the PDF for an order paid with a coupon and check the discount is shown

Defect detection percentage belongs to which category of test metrics?

1. A. Defect metrics
2. B. Cost metrics
3. C. Project progress metrics
4. D. Coverage metrics

Which is a purpose of a test plan?

1. A. To record the actual results of each test run
2. B. To replace the defect management process
3. C. To show that testing will follow the test policy and test strategy, or explain why it deviates
4. D. To list every line of code that was executed

Test effort in the last four iterations was 24, 30, 27 and 31 person-hours. Using extrapolation based on the average, what is the estimate for the next iteration?

1. A. 27 person-hours
2. B. 28 person-hours
3. C. 29 person-hours
4. D. 31 person-hours

Tests have these risk levels: T1 = 6, T2 = 9, T3 = 4, T4 = 9. T4 can only run after T3. Which execution order follows risk-based prioritization while respecting the dependency?

1. A. T2, T4, T3, T1
2. B. T1, T2, T3, T4
3. C. T3, T1, T2, T4
4. D. T2, T3, T4, T1

A team decides to buy insurance to cover a possible failure instead of testing more. Which risk response is this?

1. A. Risk transfer
2. B. Risk mitigation by testing
3. C. Risk monitoring
4. D. Risk identification

A test team is spread across India and Canada with little working-hours overlap. Which approach to communicating test status is most appropriate?

1. A. Only spoken updates in daily stand-ups
2. B. No communication until the end of the release
3. C. More formal communication, such as written reports, online documentation and dashboards
4. D. Updates only through informal hallway conversations

What happens when a configuration item is approved for testing?

1. A. It can be changed freely by anyone
2. B. It becomes a baseline that can only be changed through formal change control
3. C. It is deleted after the test run
4. D. It no longer needs a version number

When should product risk analysis ideally begin?

1. A. After system testing is complete
2. B. Only after the first production failure
3. C. During the test completion activity
4. D. Early in the SDLC

Which is the best title for a defect report?

1. A. “Checkout bug!!!”
2. B. “Doesn’t work”
3. C. “Coupon SAVE10 applied twice when the payment page is refreshed”
4. D. “Developer made a mistake in the coupon code”

A tool links requirements, test cases and defects, and reports on their status. Which type of tool is it?

1. A. Static testing tool
2. B. Non-functional testing tool
3. C. Collaboration tool
4. D. Test management tool

Which of the following is a potential benefit of test automation?

1. A. More time for testers to design new, deeper and more effective tests
2. B. No need for any maintenance of test scripts
3. C. Removing the need for human critical thinking
4. D. Independence from tool vendors