CAST Risk-Based Testing Strategies 3 — Questions and Answers
Question 1: When should risk assessment first be performed in a project lifecycle?
- As early as possible, ideally during planning (Correct answer)
- Only after coding is complete
- Only during the final release gate
- Only after the first defect is found
Correct answer: As early as possible, ideally during planning
Early risk assessment lets teams plan mitigation and allocate test effort from the start.
Question 2: What does it mean to 'mitigate' a risk through testing?
- Reduce its likelihood or impact by testing the area thoroughly (Correct answer)
- Document the risk and take no action
- Transfer the risk to another team
- Increase the risk to expose defects
Correct answer: Reduce its likelihood or impact by testing the area thoroughly
Testing mitigates risk by detecting defects early, lowering the chance of failure in production.
Question 3: A risk register should be treated as which kind of document?
- A living document updated throughout the project (Correct answer)
- A one-time artifact created at kickoff
- A confidential file only managers may read
- A static record never revisited
Correct answer: A living document updated throughout the project
Risks change over time, so the register must be reviewed and updated continuously.
Question 4: Which factor most increases the likelihood component of a risk?
- Use of new or unfamiliar technology (Correct answer)
- A simple, well-understood feature
- A feature unchanged for years
- Extensive existing automated tests
Correct answer: Use of new or unfamiliar technology
New or complex technology raises the probability of defects and therefore likelihood of failure.
Question 5: What happens to test priorities when a previously low risk becomes high mid-project?
- Test effort is reallocated to reflect the new risk level (Correct answer)
- Priorities stay fixed for consistency
- The risk is deferred to the next release
- Testing of that area is stopped
Correct answer: Test effort is reallocated to reflect the new risk level
Risk-based testing is dynamic; reassessment should trigger reallocation of effort.
Question 6: Which is an example of using risk to decide what NOT to test deeply?
- A stable, low-impact informational page gets minimal testing (Correct answer)
- The login security flow gets minimal testing
- The checkout calculation gets minimal testing
- The data backup routine gets minimal testing
Correct answer: A stable, low-impact informational page gets minimal testing
Low-likelihood, low-impact areas justify reduced testing so effort goes where risk is higher.
Question 7: How does risk-based testing support release decisions?
- It shows which residual risks remain untested or unresolved (Correct answer)
- It guarantees a defect-free release
- It removes the need for a go/no-go meeting
- It hides outstanding risks from stakeholders
Correct answer: It shows which residual risks remain untested or unresolved
Mapping testing to risks reveals residual risk, informing whether the product is safe to ship.
CAST Risk-Based Testing Strategies 3
When should risk assessment first be performed in a project lifecycle?