Free ISTQB Certified Tester Foundation Level v4.0 Sample Questions

Correct answer: A — Test execution is used to surface failures so that the underlying defects can be investigated

• A. Running tests deliberately tries to trigger failures, which are the visible symptom of an underlying defect. Surfacing these failures gives the team something concrete to investigate and address.
• B. Correcting the defect behind a failure is a development task performed through debugging, not something testers do as part of finding defects. Testers report the failure rather than fix it.
• C. Failures can stem from defects introduced in code, design, configuration, or environment, not only from the requirements. Attributing every failure to a requirements defect narrows the objective incorrectly.
• D. Test execution is precisely how remaining defects are discovered, so it is most valuable before defects have been removed. Waiting until defects are gone first would defeat the purpose of testing.

Correct answer: B — A failure can occur due to environmental conditions such as electromagnetic interference, without any underlying defect in the software.

• A. This scenario is a counterexample to that claim, since a thorough code review would find nothing when the incorrect output is caused by an external environmental condition rather than a defect.
• B. This correctly reflects that failures are not always caused by defects; environmental factors like electromagnetic interference can cause a system to misbehave on their own.
• C. Repeating the test more times would not reveal a defect that does not exist, since the incorrect output in this case originates from the external environment, not the code.
• D. Retiring the module is an unjustified overreaction, since the incorrect output stems from an external environmental factor rather than a flaw that makes the module permanently unusable.

Correct answer: A — Deriving test cases and test data from the test conditions identified earlier

• A. Turning previously identified test conditions into concrete test cases and the test data needed to exercise them is the defining task of test design.
• B. Examining the test basis to identify test conditions is test analysis, an earlier activity that feeds into test design rather than being part of it.
• C. Grouping test cases into executable test suites and procedures is test implementation, which happens after the test cases have already been designed.
• D. Preparing and verifying the test environment is a test implementation task performed to get ready for execution, not a test design task.

Correct answer: A — The number of possible input combinations, paths, and preconditions grows too large to cover every one within realistic time and budget

• A. Even a modestly sized system has so many combinations of inputs, states, and paths that testing every one is not feasible within normal schedules and budgets, which is exactly why exhaustive testing is impossible in practice.
• B. Test management tools do not impose a hard cap on test case counts; the infeasibility of exhaustive testing comes from the combinatorial size of the test object, not from tooling limits.
• C. Regulations may set minimum testing requirements for certain domains, but they do not cap how much testing may be performed, so this does not explain why exhaustive testing is unachievable.
• D. Having only one test environment can slow down execution, but the core reason exhaustive testing is impossible is the sheer number of combinations to cover, not environment availability.

Correct answer: A — Selecting conditions to cover using risk-based prioritization and techniques such as equivalence partitioning

• A. Because covering every combination is infeasible, teams prioritize conditions by risk and apply techniques such as equivalence partitioning to select a representative, manageable set of test cases and test data.
• B. The sequence in which code happens to be written has no connection to risk or requirement coverage, so using it to pick test conditions would leave important, higher-risk areas uncovered.
• C. Reusing test data from an unrelated project ignores the current test object's actual requirements and risk profile, so it does not provide a principled way to select which conditions to cover.
• D. Choosing lines of source code at random, without reference to requirements or risk, does not target the conditions most likely to reveal important defects, unlike a risk-based selection approach.

Correct answer: A — An independent perspective that can uncover defects the developers overlooked

• A. A dedicated test team separate from development introduces an independent perspective, which the syllabus describes as helpful for finding defects that the original developers were unlikely to notice in their own work.
• B. Creating a separate test team changes who performs testing, but it does not remove the need to plan what will be tested and how.
• C. Having a dedicated test team does not automate release approval; stakeholders still need to review results before a release decision is made.
• D. The syllabus warns that reduced communication is a risk of independence, not a goal; effective independent testing still requires collaboration with developers.

Correct answer: A — Critical thinking and communication ability

• A. The syllabus groups critical thinking with good communication as generic skills that increase a tester's effectiveness in identifying and reporting defects clearly.
• B. Graphic design and video editing are creative production skills unrelated to the generic tester skills the syllabus describes.
• C. Payroll and invoicing are administrative finance tasks with no connection to the skills the syllabus lists for testers.
• D. Warehouse logistics and inventory management are supply-chain skills that do not appear among the generic testing skills in the syllabus.

Correct answer: A — Checking backup and restore procedures, disaster recovery, and routine maintenance tasks

• A. Operational acceptance testing checks non-functional, operational aspects such as backup and restore procedures, disaster recovery, user management, and maintenance tasks before the system goes live.
• B. Verifying source code against coding standards and design guidelines is a static analysis or component-level activity, not part of operational acceptance testing.
• C. Comparing individually tested components using stubs and drivers describes component integration testing, which happens far earlier than operational acceptance testing.
• D. Reviewing signed contracts and regulations describes contractual and regulatory acceptance testing, a different form of acceptance testing focused on legal compliance rather than operations.

Correct answer: A — Component integration testing

• A. Verifying that data exchanged between two already individually tested components, such as checkout and payment modules, is formatted and interpreted correctly is component integration testing.
• B. Component testing examines a single module in isolation, but this scenario specifically checks the interaction between two modules that have already passed their own tests.
• C. System integration testing addresses interfaces between separate systems or a system and external services, not interactions between components inside the same application.
• D. Operational acceptance testing checks operational concerns like backup and maintenance, not the data interaction between two internal components.

Correct answer: A — Write a failing unit test for the desired behavior, then write just enough code to make it pass, then refactor

• A. Writing a failing test before any production code, then implementing the minimal code to pass it and refactoring afterward, is the defining cycle of test-driven development.
• B. Writing code first and tests afterward is the reverse of test-driven development, since TDD specifically requires the test to exist and fail before the corresponding code is written.
• C. Having stakeholders write acceptance criteria describes acceptance test-driven development rather than TDD, and omitting developer-written tests altogether is not consistent with either approach.
• D. Relying on production monitoring to catch defects after deployment is a shift-right practice, not a test-first approach, since no test exists before the code is written.

Correct answer: A — A company moves its order-processing application from an on-premises server to a cloud platform

• A. Moving an application from one platform to another, such as from on-premises servers to a cloud platform, is a migration, which requires testing the operability of the software in its new environment.
• B. Adding a new feature in response to a customer request is a planned enhancement change, which falls under the modification trigger rather than migration.
• C. Fixing a defect that produces incorrect totals is a corrective change, which is also classified under the modification trigger rather than migration.
• D. Shutting down an application because it is no longer used describes the retirement trigger, since the system is reaching the end of its life rather than moving to a new platform.

Correct answer: A — The areas of the system that could be affected by the change, based on documentation and knowledge

• A. Impact analysis identifies the areas of the system that a change could affect, drawing on available documentation and the knowledge that testers and developers have of the system.
• B. Counting the testers who worked on the original development effort is a historical staffing detail, not something impact analysis sets out to determine.
• C. Planning how a change will be announced to end users is a marketing activity, unrelated to identifying which parts of the system a change could affect.
• D. The billing arrangement with a test tool vendor is a procurement matter and has no bearing on identifying areas of the system affected by a change.

Correct answer: A — A security vulnerability caused by an unvalidated input parameter in the source code

• A. A static analysis tool can scan source code for patterns such as unvalidated input handling and flag potential security vulnerabilities without ever running the program, which is a well-known capability of static analysis.
• B. Identifying a slow database query as the application processes live requests requires the system to actually be running and handling traffic, which makes this an outcome of dynamic testing.
• C. Observing an incorrect displayed value during a manual test session depends on someone executing the software and interacting with it, so this is a dynamic testing finding rather than a static one.
• D. A timeout triggered by exceeding a load limit can only be observed while the system is running under that load, which places this firmly within dynamic testing rather than static analysis.

Correct answer: A — Frequent stakeholder feedback prevents requirement misunderstandings and clarifies changes earlier

• A. Frequent stakeholder feedback throughout the SDLC prevents misunderstandings about requirements and ensures that changes are understood and implemented earlier, helping the team focus on the highest-value features.
• B. Stakeholder feedback is a communication and review activity; it does not eliminate the value of static analysis tools, which check code and models against structural rules.
• C. Stakeholder feedback improves shared understanding early on, but it does not make dynamic testing optional, since some defects can only be found by executing the software.
• D. A test basis is still needed to design tests regardless of how much stakeholder feedback is gathered; feedback informs the test basis rather than replacing it.

Correct answer: A — An entity or property used as a basis for test analysis and design, such as an equivalence partition or code branch

• A. This is correct: a coverage item is an entity or property, such as an equivalence partition, a branch, or a requirement, used as a basis for test analysis and design and against which coverage is measured.
• B. A logged defect linked to a test case is a defect management artifact, not the entity or property that coverage measurement is based on.
• C. A tool license entitlement is an administrative or tool-support concept and has no connection to how coverage items are defined for test design.
• D. A stakeholder sign-off is a management or exit-criteria activity, not an entity or property used as the basis for measuring test coverage.

Correct answer: A — A defined, repeatable procedure applied to derive and/or select test cases from a chosen test basis

• A. This is correct: a test technique is a defined, repeatable procedure used to derive or select test conditions, test cases, or test data from a chosen test basis.
• B. A test technique is a procedural concept, not a specific software tool, and it is not limited to executing automated regression suites.
• C. A formal contract between a test team and stakeholders describes a project agreement, not the procedural concept of a test technique.
• D. Defect density is a quality metric reported after test execution, which is unrelated to the procedural definition of a test technique used in test design.

Correct answer: A — To divide a set of input or output values into partitions expected to be handled the same way, then test one representative value from each partition

• A. This is correct: equivalence partitioning groups data that a component should process the same way into partitions, and testing one representative member of each partition is assumed to test the whole partition.
• B. Focusing only on values at the edges of a range describes boundary value analysis, not equivalence partitioning, even though the two techniques are closely related and often used together.
• C. Building a table of conditions and their resulting actions describes decision table testing, which targets combinations of business logic rather than partitions of a data range.
• D. Modeling a component as states and transitions describes state transition testing, which is used when the software's behavior depends on its current state and prior history, not on data ranges.

Correct answer: A — One invalid partition of numbers less than 1, one valid partition of 1 through 100, and one invalid partition of numbers greater than 100

• A. This is correct: equivalence partitioning for a bounded valid range creates one valid partition for the accepted range and one invalid partition on each side, covering values both below and above the range.
• B. Treating every accepted number as one partition is correct in itself, but omitting invalid partitions leaves out-of-range inputs untested, which contradicts the purpose of partitioning a bounded field.
• C. Splitting the valid range into several smaller blocks contradicts the idea of a partition, since equivalence partitioning assumes all values within a single valid partition are handled identically and need only one representative test.
• D. Omitting the invalid partition for values above the range leaves that side of the field untested, even though the field logically rejects numbers greater than 100 just as it rejects numbers below 1.

Correct answer: A — Error guessing does not offer a systematic way to measure the test coverage it achieves

• A. Because error guessing is based on informal, experience-driven judgment rather than a systematic model of the test object, there is no defined coverage item to measure completeness against. This is a widely cited limitation of the technique.
• B. Statement coverage percentages come from executing code and tracking which statements ran, which is unrelated to the informal reasoning process used in error guessing.
• C. Guaranteeing full coverage of equivalence classes is a property associated with systematic equivalence partitioning, not with the ad hoc, experience-based nature of error guessing.
• D. Error guessing is a complement to, not a replacement for, other black-box and white-box techniques, since it targets defects those systematic techniques might miss rather than covering everything on its own.

Correct answer: A — Tester and organizational experience, along with standards, laws, or regulations

• A. Checklists commonly draw on the tester's own experience, organizational knowledge accumulated over past projects, and applicable standards, laws, or regulations that the test object must satisfy.
• B. Randomly sampled logs from unrelated systems are not the source of a checklist's test conditions and would not reliably reflect knowledge relevant to the current test object.
• C. Code coverage reports summarize what was executed after testing occurs and are not the experience-based or regulatory sources that typically inform a checklist's content.
• D. Checklists rely on tester and organizational judgment rather than a single automated tool output with no human review, since experience-based interpretation is central to building a useful checklist.

Correct answer: A — Test cases are derived from analyzing the internal structure of the component or system

• A. This is correct: white-box techniques derive test cases by analyzing the internal structure of the component or system, such as its code, rather than only its external behavior.
• B. Deriving test cases solely from specified functional requirements describes black-box testing, not white-box testing.
• C. Relying on tester experience and intuition describes experience-based testing, a separate category from white-box testing.
• D. Deriving test cases from stakeholder workshops describes collaboration-based approaches, not the structural analysis used in white-box testing.

Correct answer: A — 50%, because only one of the two possible branch outcomes was exercised

• A. This is correct: with only two possible outcomes for the single decision, exercising just the true outcome achieves half of the branch coverage items, or 50%.
• B. Executing statements inside the if-branch reflects statement coverage of that branch's contents, not whether the else-branch outcome was also exercised.
• C. Some coverage was achieved, since the true outcome was exercised, so the result cannot be 0%.
• D. Evaluating the condition once only exercises one of its two possible outcomes, so full branch coverage was not reached.

Correct answer: A — A collaborative practice where the team derives acceptance tests from acceptance criteria before development begins

• A. This is correct: ATDD is a collaborative practice in which business representatives, developers, and testers derive concrete acceptance tests from the agreed acceptance criteria before coding starts.
• B. Measuring code coverage after development is a white-box testing activity, not the collaborative, criteria-driven practice that defines ATDD.
• C. Automating regression tests after release is a separate test automation activity and happens later in the lifecycle than the derivation of tests in ATDD.
• D. Negotiating story points is an estimation activity during planning, distinct from deriving acceptance tests from acceptance criteria in ATDD.

Correct answer: A — Contributing a testing perspective to identify missing scenarios and edge cases in the examples

• A. This is correct: the tester brings a quality-focused perspective, helping the team spot missing scenarios and edge cases while the examples are still being defined.
• B. Writing the production code is the developer's responsibility, not the tester's role during the collaborative derivation of examples in ATDD.
• C. Approving a budget is a business or management decision unrelated to the tester's contribution of a quality perspective during ATDD discussions.
• D. Prioritizing stories for a release is typically a product owner responsibility, not a decision the tester makes alone during ATDD.

Correct answer: A — Wideband Delphi, where several specialists provide judgment-based estimates and then discuss

• A. Wideband Delphi has specialists independently estimate and then converge through discussion, which is a classic example of expert-based estimation relying on specialist judgment.
• B. Analyzing historical defect counts to project future effort is a metrics-based technique, since it relies on recorded data rather than expert judgment sessions.
• C. Automated coverage measurement is a test result metric produced by tooling, not a technique for estimating how much testing effort is required.
• D. A burn-down chart tracks progress against committed work automatically and is a monitoring artifact, not an estimation technique based on expert judgment.

Correct answer: A — To run the most important test cases first under time or resource limits

• A. Prioritization orders test cases so the most important ones, often those covering higher risk or critical functionality, run first when time or resources are constrained.
• B. Requiring full automation before release is an automation strategy decision, not the purpose of ordering which tests run first based on importance.
• C. Assigning one tester per test case is a staffing or work-allocation decision, unrelated to determining the order in which test cases should be executed.
• D. Permanently deleting tests that have not failed removes coverage rather than reordering execution, which contradicts the intent of prioritization.

Correct answer: A — The complexity of the code and the experience level of the team building it

• A. Factors such as code complexity, technical difficulty, and team skill or experience directly influence how probable it is that a defect will occur, which is what likelihood measures.
• B. Marketing budget affects promotion of the product, not the probability that a defect exists within it.
• C. Support staffing levels are a post-release operational decision and do not affect the probability of a defect occurring in the software.
• D. Visual design choices like color scheme are unrelated to the technical probability of a failure occurring.

Correct answer: A — A project risk, because it threatens the organization's ability to manage the project effectively

• A. Inadequate stakeholder involvement is an organizational and communication issue that threatens the project's ability to deliver clear, well-managed outcomes, which is characteristic of a project risk.
• B. No defect in the software itself has been described here; the issue concerns unclear requirements, not a flaw in the product's behavior.
• C. Runtime performance is unrelated to this scenario, which concerns unclear acceptance criteria stemming from stakeholder engagement.
• D. Unauthorized access concerns are unrelated to this scenario, which is about ambiguous requirements rather than a security vulnerability.

Correct answer: A — Gathering information about test activities and comparing actual progress against the test plan

• A. This is correct because test monitoring is the ongoing collection and recording of data about test progress so it can be compared with what was planned. It produces the information that later feeds decisions about whether corrective action is needed.
• B. Taking corrective action to realign testing with the plan describes test control, which happens after monitoring has revealed a deviation. Monitoring itself only observes and reports, it does not act.
• C. Confirming that exit criteria are satisfied is part of test completion, not ongoing monitoring. Monitoring supplies the data used for that later evaluation but does not itself constitute the completion check.
• D. Defining the test strategy and scope is a test planning activity that happens before execution starts. Monitoring is a continuous activity performed while testing is underway, not a one-time upfront definition.

Correct answers: A, B — An evaluation of the testing performed against the agreed exit criteria for the test level; A summary of relevant testware and the lessons learned during the test level

• A. This is correct because evaluating testing results against the agreed exit criteria is a core purpose of a test completion report, informing the release recommendation.
• B. This is correct because summarizing relevant testware and capturing lessons learned are standard contents of a completion report, helping later test levels or projects improve.
• C. A minute-by-minute keystroke log is an impractical level of detail that is never part of standard test reporting and would not aid stakeholders evaluating test results.
• D. The complete source code of the application is a development artifact, not testware summary content that belongs in a report evaluating test results and exit criteria.
• E. A forecast of an unrelated marketing budget has no connection to testing activities and would not appear in a report evaluating test completion against exit criteria.

Correct answer: A — Configuration management version controls testware, while risk management analyzes likelihood and impact

• A. Configuration management is concerned with identifying, controlling, and version-tracking testware as configuration items, while risk management separately analyzes risk likelihood and impact to influence test thoroughness and scope.
• B. This reverses the two disciplines: likelihood and impact analysis belongs to risk management, while version control of testware belongs to configuration management.
• C. Defect logging and classification is the concern of defect management, a third distinct activity, not the shared scope of configuration management and risk management.
• D. Drafting the completion report is a test monitoring and completion activity, not something configuration management or risk management is scoped to perform.

Correct answer: A — When an actual result observed during testing deviates from the expected result

• A. A defect is raised precisely because the observed behavior does not match the expected behavior, which is the trigger condition for logging a defect report during or after test execution.
• B. A successful test execution with no anomaly gives no reason to raise a defect report, since there is nothing unexpected to document.
• C. Adding a new requirement is a backlog or requirements management activity and is unrelated to observing a discrepancy during test execution.
• D. Approval of a test plan is a planning milestone and has no connection to an observed failure that would justify raising a defect report.

Correct answer: A — Identification of the test item or component and the test environment where the defect occurred

• A. Naming the affected test item or component along with the environment tells the investigator exactly where the defect occurred, which is essential context alongside the description of the failure.
• B. A full list of non-functional requirements describes product scope, not the specific item and environment in which one defect was found.
• C. Vendor contract terms for a tool are a procurement matter and have no bearing on identifying where a defect occurred.
• D. Performance benchmarks from a prior release describe historical measurements, not the item or environment tied to the current defect.

Correct answer: A — Connect test execution tools to a continuous integration tool that watches the version control repository

• A. Connecting test execution tools to a continuous integration tool that monitors the repository allows the regression suite to run and report automatically on every push, which is exactly the outcome the team wants.
• B. Relying on testers to manually rerun the suite before pushing does not provide automatic triggering on every push and does not scale as a repeatable, tool-supported CI/CD practice.
• C. A static analysis tool checks code structure without executing it, so it cannot run the regression test suite or publish execution results as the scenario requires.
• D. A test data preparation tool creates input values for test conditions but does not trigger test execution or publish results, so it does not address the automation need described.

Correct answer: A — Spending too much time automating a test that would have been more efficient to execute manually

• A. Correct. Automating a one-off, short-lived test consumes more effort than the manual alternative would have, which is precisely the risk of misjudging when automation is worthwhile.
• B. Incorrect. The scenario is about a poor automation decision for a one-time test, not about failing to track script versions after creation.
• C. Incorrect. Vendor support arrangements are unrelated to choosing to automate a short-lived, single-use test case.
• D. Incorrect. There is no mention of a vendor withdrawing the tool or restricting source code access in this scenario.