ISTQB Certified Tester Foundation Level (CTFL) — Questions and Answers

Question 1: What forms the basis of acceptance test cases?

Requirements (Correct answer)
Code
Create
Table of decisions

Correct answer: Requirements

Acceptance test cases are designed to verify that the system meets the business needs and user expectations, ensuring it is fit for purpose. Therefore, these tests are directly derived from the user requirements or business requirements specification. They confirm that the software delivers the functionality originally requested by stakeholders and is acceptable for deployment.

Question 2: What is the role of a 'test coordinator' in a large project with multiple test teams?

To approve software releases based on test results
To execute all automated regression tests
To write all test cases for the project
To coordinate test activities, resources, and communications across teams (Correct answer)

Correct answer: To coordinate test activities, resources, and communications across teams

A test coordinator synchronizes activities, resources, and communication across multiple test teams.

Question 3: What is the main purpose of a test policy in an organization?

State the organization's principles and approach to testing (Correct answer)
Specify the tools to be used for testing
Define specific test cases for each project
Assign testers to specific projects

Correct answer: State the organization's principles and approach to testing

A test policy defines the organization's high-level principles, objectives, and approach to testing, guiding how testing is practiced across projects.

Question 4: Which document defines the scope, approach, resources, and schedule of planned testing activities?

Test summary report
Incident report
Test plan (Correct answer)
Test log

Correct answer: Test plan

The test plan outlines scope, approach, resources, and schedule for all testing activities.

Question 5: Assume once more the scenario from the previous questions, in which you are a test manager working on a project to create a programmable thermostat for home use to control central HVAC (heating, ventilation, and air conditioning) systems. The possibility of excessive compressor cycling, or turning the unit on and off repeatedly at short intervals, causing damage to the HVAC system, has been identified as a critical quality risk for this system. Which of the following best describes how an IEEE 829 test plan may be used to guide relevant testing for this risk?

Add the feature that stops overcycling to the list of features that need testing. (Correct answer)
For this level of testing, create a different test plan.
One of the test items should be a compressor that is operating properly.
In the test plan's introduction, list every need for the programmable thermostat.

Correct answer: Add the feature that stops overcycling to the list of features that need testing.

The IEEE 829 standard for test plans includes sections for 'Features to be Tested' and 'Features Not to be Tested.' Since excessive compressor cycling is identified as a critical quality risk, the feature designed to prevent this (the overcycling prevention mechanism) should be explicitly listed under 'Features to be Tested.' This ensures that specific testing efforts are dedicated to verifying the functionality that mitigates this critical risk, aligning the test plan with the risk analysis.

Question 6: A tester achieves 100% statement coverage on a module. What can they conclude?

All paths have been tested
Every executable statement was executed at least once (Correct answer)
All branches have been tested
All conditions evaluated to both true and false

Correct answer: Every executable statement was executed at least once

100% statement coverage only guarantees every executable statement was executed at least once; branches and paths may remain untested.

Question 7: According to ISTQB, which of the following is an example of a 'project risk' (as opposed to a product risk)?

Key test personnel may leave the project mid-cycle (Correct answer)
The user interface may not meet accessibility standards
A critical module may contain undetected security vulnerabilities
The payment processing feature may calculate totals incorrectly

Correct answer: Key test personnel may leave the project mid-cycle

Project risks threaten the test project's success, such as personnel turnover, while product risks relate to the software quality.

Question 8: During a formal review, who is responsible for ensuring the review meeting runs smoothly and that all participants contribute effectively?

Author
Reviewer
Moderator/Facilitator (Correct answer)
Manager

Correct answer: Moderator/Facilitator

The moderator or facilitator is responsible for planning, running, and following up on the review meeting to ensure it is effective.

Question 9: Which coverage criterion requires that every loop in the code is executed at least once with zero iterations, one iteration, and multiple iterations?

Statement coverage
Loop coverage (Correct answer)
Branch coverage
Path coverage

Correct answer: Loop coverage

Loop coverage specifically targets loop constructs by requiring execution with zero, one, and multiple iterations to reveal off-by-one and boundary errors.

Question 10: A performance testing tool is being used to simulate 500 concurrent users on a web application. What term describes the simulated users generated by the tool?

Stubs
Test drivers
Virtual users (Correct answer)
Probes

Correct answer: Virtual users

Virtual users (VUs) are simulated entities generated by performance testing tools to mimic real user behavior and load on a system.

Question 11: Which of the following is a significant risk that must be managed when implementing test automation?

The ability to run regression tests more frequently and consistently.
Improved objectivity in test results compared to manual execution.
Unrealistic expectations and underestimation of the effort needed to maintain test scripts. (Correct answer)
A reduction in the time required for repetitive test execution cycles.

Correct answer: Unrealistic expectations and underestimation of the effort needed to maintain test scripts.

A common and significant risk in test automation is having unrealistic expectations about the tool's benefits and underestimating the considerable time, cost, and effort required for the initial introduction, training, and ongoing maintenance of the test scripts and framework.

Question 12: Which SDLC characteristic makes automated test maintenance most challenging?

Stable requirements throughout development
Dedicated test environments
Frequent changes to the application under test (Correct answer)
Long release cycles with infrequent builds

Correct answer: Frequent changes to the application under test

Frequent application changes require constant test script updates, increasing maintenance overhead and making automated testing more costly to sustain.

Question 13: In exploratory testing, what is a 'test charter'?

A defect report template used during testing
A formal test plan approved by management
A checklist of all test cases to execute
A mission statement defining the scope and goals of an exploration session (Correct answer)

Correct answer: A mission statement defining the scope and goals of an exploration session

A test charter defines the purpose, scope, and target of an exploratory testing session, guiding the tester's exploration.

Question 14: When introducing a new test automation tool into an organization, what is a primary objective of conducting a pilot project?

To automate all existing manual regression tests immediately.
To train all testers in the organization on the new tool.
To assess the tool's suitability for the organization and learn how to best adapt it to existing processes. (Correct answer)
To negotiate the final licensing cost with the tool vendor.

Correct answer: To assess the tool's suitability for the organization and learn how to best adapt it to existing processes.

A pilot project's main purpose is to evaluate if a tool is a good fit on a small scale before a full rollout. Key objectives include learning about the tool in detail, understanding how it fits with current processes, and defining standards for its use.

Question 15: What testing challenge is unique to maintenance testing compared to new development testing?

Maintenance testing has no test basis
Impact analysis is needed to determine what regression testing is required (Correct answer)
Maintenance testing cannot use automated tools
Maintenance testing requires more testers

Correct answer: Impact analysis is needed to determine what regression testing is required

Maintenance testing requires impact analysis to understand which parts of the existing system are affected by changes, determining the scope of needed regression testing.

Question 16: During test execution, the team discovers that 30% more defects than expected are being found. What should the test manager consider FIRST?

Assess whether additional time and resources are needed to complete testing (Correct answer)
Immediately halt testing and notify management of project failure
Reduce the number of test cases to meet the original schedule
Remove the testers who are logging too many defects

Correct answer: Assess whether additional time and resources are needed to complete testing

Higher-than-expected defect rates require the test manager to evaluate whether the plan needs adjustment for resources and schedule.

Question 17: In risk-based testing, what does 'risk exposure' represent?

The total testing effort allocated to high-risk areas
The percentage of requirements covered by tests
The product of likelihood and impact of a risk (Correct answer)
The number of defects found during testing

Correct answer: The product of likelihood and impact of a risk

Risk exposure is calculated as the product of the probability (likelihood) that a risk will occur and the impact it would have if it did occur.

Question 18: Which defect type is MOST commonly found by static analysis tools but NOT easily found by dynamic testing?

Race conditions during concurrent access
Unreachable (dead) code segments (Correct answer)
User interface layout issues
Performance bottlenecks under heavy load

Correct answer: Unreachable (dead) code segments

Static analysis tools excel at finding unreachable code because they analyze control flow without needing the code to be executed.

Question 19: A tester with no prior knowledge of the system under test is asked to perform exploratory testing. What is the LIKELY outcome compared to an experienced tester?

The inexperienced tester may find some defects but will likely miss domain-specific issues (Correct answer)
The inexperienced tester cannot perform exploratory testing at all
The inexperienced tester will find more defects due to fresh perspective
Both testers will find exactly the same defects

Correct answer: The inexperienced tester may find some defects but will likely miss domain-specific issues

While a fresh perspective can surface some issues, domain experience significantly improves defect detection in exploratory testing.

Question 20: In a decision table, what does each column typically represent?

A single test condition
One expected output value
A unique combination of conditions and corresponding actions (Correct answer)
A sequence of test steps

Correct answer: A unique combination of conditions and corresponding actions

Each column (rule) in a decision table represents a unique combination of input conditions and the expected system action or output.

Question 21: A tester finds that repeated use of the same test cases over time stops detecting new defects. Which ISTQB principle explains this?

Pesticide paradox (Correct answer)
Testing is context dependent
Early testing saves time and money
Defects cluster together

Correct answer: Pesticide paradox

The pesticide paradox states that if the same tests are repeated, they eventually stop finding new bugs and must be reviewed and updated.

Question 22: Which of the following best describes a model-based testing tool?

A tool that manages the test environment configuration
A tool that measures how closely actual results match expected results
A tool that simulates network latency for performance testing
A tool that generates test cases automatically from a behavioral model of the system (Correct answer)

Correct answer: A tool that generates test cases automatically from a behavioral model of the system

Model-based testing tools derive test cases from formal models (e.g., state machines, decision tables) that represent expected system behavior.

Question 23: What is the main purpose of a static analysis tool in the context of static testing?

To execute the code and observe its runtime behavior
To generate test cases automatically from requirements
To measure the performance of the software under load
To analyze source code or models without executing them (Correct answer)

Correct answer: To analyze source code or models without executing them

Static analysis tools examine code or models without execution, identifying potential defects like unreachable code or violations of coding standards.

Question 24: A tester logs a defect and includes a unique ID, a title, steps to reproduce, actual results, and expected results. According to ISTQB, which of the following essential pieces of information is missing from this defect report?

The estimated time to fix the defect.
A link to the automated test script that found the defect.
Identification of the test object (what was tested) and the test environment. (Correct answer)
The developer assigned to fix the defect.

Correct answer: Identification of the test object (what was tested) and the test environment.

A standard ISTQB-compliant defect report should include identification of the test item (the software or component being tested) and the environment in which the defect was found. This information is crucial for developers to reproduce the issue accurately. While developer assignment and fix estimates are added later in the lifecycle, and a link to a script is helpful but not always mandatory, the test object and environment are considered fundamental initial details.

Question 25: What is the primary goal of regression testing in iterative development?

Measure code coverage metrics
Test all features from scratch each iteration
Find new defects introduced by recent changes
Verify that previously working functions still work after changes (Correct answer)

Correct answer: Verify that previously working functions still work after changes

Regression testing ensures that changes, fixes, or new features have not broken previously working functionality.

Question 26: At which test level are user stories most commonly used as the test basis in Agile development?

Component testing
Acceptance testing (Correct answer)
System testing
Integration testing

Correct answer: Acceptance testing

In Agile, acceptance testing often uses user stories and acceptance criteria as the test basis to validate business value from the user's perspective.

Question 27: When a test manager selects a tool to support test management, which of the following capabilities is MOST important?

Built-in support for writing tests in a specific scripting language
Support for tracking test plans, test cases, execution results, and defects in one place (Correct answer)
Ability to generate executable test scripts automatically
Integration with hardware performance monitoring systems

Correct answer: Support for tracking test plans, test cases, execution results, and defects in one place

Test management tools must consolidate planning, execution tracking, results, and defect linkage to give managers a complete view of test progress.

Question 28: A tester suspects that a specific module is prone to defects related to handling invalid inputs, based on issues found in previous versions of the software. The tester decides to create a list of potential failures, such as buffer overflows and division by zero, and design specific tests to trigger them. This systematic approach is an example of:

Fault attack (Correct answer)
Checklist-based testing
State transition testing
Exploratory testing

Correct answer: Fault attack

A fault attack is a systematic approach to error guessing. It involves creating a list of potential defects, failures, and errors based on experience and data, and then designing tests specifically to target and uncover these faults. This is a more structured application of the error guessing technique.

Question 29: A moderator in a review meeting is someone who:

Answers phone calls
bridges interpersonal conflicts (Correct answer)
captures meeting minutes
creates the papers that need to be examined

Correct answer: bridges interpersonal conflicts

In a formal review meeting, such as a peer review or inspection, the moderator's primary role is to facilitate the session and ensure it remains productive and focused. This includes managing time, guiding discussions, and crucially, mediating any interpersonal conflicts or disagreements that may arise among participants. Their goal is to maintain a constructive environment for effective defect detection.

Question 30: Proceed with the scenario that was previously explained. Which of the following subjects would the master test plan need to cover in-depth?

An explanation of dependencies between cases
A regression testing approach (Correct answer)
An orderly set of test cases
A list of boundary values for the advance amount

Correct answer: A regression testing approach

A master test plan outlines the overall testing strategy for a project. For a system modernization project like the ATM update, where new features are added to an existing system, a robust regression testing approach is crucial. This ensures that the new changes do not negatively impact existing functionality, which is a significant risk in such projects and therefore needs detailed planning in the master test plan.

Question 31: A project is experiencing frequent delays in receiving testable builds from the development team and a shortage of skilled testing staff. In the context of risk-based testing, how are these risks BEST categorized?

Technical Risks
Product Risks
Project Risks (Correct answer)
Business Risks

Correct answer: Project Risks

Project risks are those that relate to the management and control of the project, affecting its ability to achieve its objectives on time and within budget. [10, 13] Delays in deliverables and staff shortages are classic examples of organizational and people issues that impact the project's schedule and resources, rather than the intrinsic quality of the software itself. [6, 12, 18]

Question 32: A tester is analyzing requirements for a feature that describes the lifecycle of a document in a content management system (e.g., Draft, In Review, Published, Archived). The system's behavior changes depending on the document's current status and the user's action. Which black-box technique is MOST suitable for designing tests for this feature?

State Transition Testing (Correct answer)
Boundary Value Analysis
Equivalence Partitioning
Decision Table Testing

Correct answer: State Transition Testing

State Transition Testing is specifically designed for systems where the behavior depends on its current state and past events. It models the different statuses (states) of an object and the events (transitions) that cause it to change state, which is a perfect match for testing a document lifecycle.

Question 33: You are determining risk priorities in a formalized quality risk analysis session that uses the Failure Mode and Effect Analysis technique. In this calculation, which of the following is an important factor?

Features: efficiency, functionality, portability, maintainability, usability, and reliability
Priority and severity (Correct answer)
death of a vital member of the test team
death of a vital member of the development team

Correct answer: Priority and severity

Failure Mode and Effect Analysis (FMEA) is a systematic approach to identifying potential failure modes, their causes, and their effects. In FMEA, risks are typically prioritized based on their severity (impact), occurrence (likelihood), and detectability. Therefore, 'Priority and severity' are crucial factors used to rank and address identified risks, guiding where testing efforts should be focused to maximize risk reduction.

Question 34: Which ISTQB testing principle warns against relying solely on one testing technique or focusing testing only on familiar areas?

Pesticide paradox (Correct answer)
Absence-of-errors fallacy
Defects cluster together
Testing is context dependent

Correct answer: Pesticide paradox

The pesticide paradox states that repeatedly running the same tests will eventually stop finding new defects, requiring tests to be regularly reviewed and revised.

Question 35: A team is reviewing a requirements document and using a checklist to verify completeness, consistency, and testability. What review technique are they applying?

Perspective-based reading
Checklist-based reviewing (Correct answer)
Ad hoc reviewing
Scenario-based reviewing

Correct answer: Checklist-based reviewing

Checklist-based reviewing uses a predefined list of questions to systematically evaluate specific quality attributes of the work product.

Question 36: A defect is marked as 'deferred.' Which of the following best explains this status?

The defect is acknowledged but repair is postponed to a future release (Correct answer)
The defect has been fixed but not yet verified
The defect report is awaiting triage review
The defect cannot be reproduced

Correct answer: The defect is acknowledged but repair is postponed to a future release

A deferred defect is one that the team has decided to fix in a later release rather than the current one.

Question 37: Which type of review is the most formal, requiring entry/exit criteria, defined roles, and a recorded outcome?

Technical review
Informal review
Walkthrough
Inspection (Correct answer)

Correct answer: Inspection

Inspections are the most formal review type, following a documented process with defined roles (moderator, author, reviewers), checklists, and formal defect logging.

Question 38: Which of the following is an example of a non-functional test tool?

A mutation testing tool such as PIT
A behavior-driven development tool such as Cucumber
A load testing tool such as Apache JMeter (Correct answer)
A unit testing framework such as JUnit

Correct answer: A load testing tool such as Apache JMeter

Load testing tools like Apache JMeter evaluate non-functional characteristics such as performance, scalability, and reliability under simulated load.

Question 39: Envision yourself as a test manager engaged in a project to develop a programmable thermostat intended for residential usage, which would regulate HVAC systems (central heating, ventilation, and air conditioning). Apart from its standard HVAC control features, the thermostat can also transfer data to a PC browser-based application for additional study. As a quality risk item with a high probability, compatibility issues between the browser-based application and the various PC setups that potentially host it are found during quality risk analysis. Compatibility testing is your planned solution to mitigate this risk. How would you go about tracking how testing affects this risk reduction while the test is being run?

Examine how many flaws were discovered in relation to this risk item. (Correct answer)
Make time to test the most typical PC setup.
Assign more testers to the compatibility domain than the functionality domain.
Decrease the amount of PC configurations that are supported

Correct answer: Examine how many flaws were discovered in relation to this risk item.

To track how testing affects risk reduction, it's essential to monitor the effectiveness of the tests in identifying issues related to that specific risk. By examining the number of flaws discovered that are directly linked to compatibility issues, the test manager can assess whether the compatibility testing is effectively uncovering and mitigating this high-probability risk. A high number of discovered flaws indicates that the risk was real and the testing is working to expose it.

Question 40: Which of the following BEST describes 'traceability' in test management?

The ability to track defects back to the tester who found them
The ability to link test cases to requirements, ensuring test coverage can be demonstrated (Correct answer)
The ability to determine how long each test case takes to execute
The process of tracking software versions through source control

Correct answer: The ability to link test cases to requirements, ensuring test coverage can be demonstrated

Traceability means linking test cases to requirements so that coverage can be measured and verified.

ISTQB Certified Tester Foundation Level (CTFL)

The ISTQB CTFL exam validates foundational knowledge of software testing concepts, techniques, and processes, recognized internationally as the standard entry-level testing certification.

Questions

60 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

astqb.org — Test delivery, fees, retake policy · verified Oct 2026
istqb.org — Score validity, exam format, time limit, eligibility, renewal, passing score, exam information · verified Oct 2026