ISTQB Cheat Sheet 2026

The 30 highest-yield ISTQB facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In control flow testing, what is a 'predicate' node? → A node where the flow splits based on a condition
2. Which of the following statements about exploratory testing is TRUE? → Test design and execution happen simultaneously
3. At which test level are user stories most commonly used as the test basis in Agile development? → Acceptance testing
4. During which phase of a formal review process do participants examine the work product to identify potential defects BEFORE the review meeting? → Individual Preparation
5. During which phase of the SDLC is test basis analysis most appropriately performed? → As early as the requirements phase
6. In the ISTQB Advanced Level Test Manager syllabus, what is the purpose of a product risk analysis? → To identify what could go wrong with the product and use that to guide test prioritization
7. A software team applies static testing to check that all variables are initialized before use. Which category of defect are they targeting? → Code defects detectable by static analysis
8. What is the purpose of a traceability matrix in testing? → To link requirements to test cases, ensuring complete coverage and impact analysis
9. Which work product type is LEAST suitable for static testing via peer review? → Runtime memory dump from a crashed application
10. Which of the following is an example of functional testing? → Verifying that a login form rejects invalid credentials
11. Error guessing is MOST effective when: → The tester has experience with similar systems and typical failure modes
12. When should risk assessments be updated during a project lifecycle? → Continuously throughout the project as new information becomes available
13. Which of the following BEST defines 'test coverage'? → The degree to which specified coverage items have been exercised by tests
14. Which coverage criterion requires that every statement in the code is executed at least once? → Statement coverage
15. Which of the following BEST describes the purpose of a state transition table compared to a state diagram? → It provides a tabular view that makes missing transitions easier to identify
16. According to ISTQB, what is a 'test stub'? → A simplified version of a called component used to isolate the unit under test
17. A test engineer wants to record a user interaction with a web application and replay it later. Which tool type supports this? → Capture/replay tool
18. A moderator in a review meeting is someone who: → bridges interpersonal conflicts
19. A tool that identifies the percentage of code exercised by a set of tests is called a: → Code coverage tool
20. A software component has the Boolean expression `if (x > 0 && y != 0)`. To achieve MC/DC, which set of test cases is SUFFICIENT? → TC1: x=1,y=1 (T,T); TC2: x=-1,y=1 (F,T); TC3: x=1,y=0 (T,F)
21. A password field requires 8 to 16 characters. Using 3-value BVA, which set of test values is complete? → 7, 8, 9, 15, 16, 17
22. A use case has 3 alternative flows in addition to the basic flow. How many test scenarios are minimally required to achieve basic use case coverage? → 4
23. A defect is found in a module that was recently changed. In ISTQB terminology, this type of defect introduced by a change is called a: → Regression defect
24. Which defect management metric best indicates the effectiveness of the testing process itself? → Defect detection percentage (DDP)
25. What is the primary benefit of pairing an experienced tester with a domain expert during exploratory testing? → It combines testing knowledge with domain insight to improve defect detection
26. In ISTQB terminology, a tool that simulates the behavior of missing software components during testing is called a: → Test harness
27. Which of the following BEST describes a 'product risk' in the context of test management? → The risk that a software work product may fail to satisfy stakeholder needs
28. During which activity of the Fundamental Test Process are the overall testing objectives and test approach defined? → Test Planning and Control
29. A tool that analyzes source code to detect security vulnerabilities such as SQL injection or buffer overflows without executing the code is known as a: → Static application security testing (SAST) tool
30. While test execution tools are highly effective for automating repetitive tasks, for which of the following activities would manual testing be more appropriate? → Assessing the usability and user-friendliness of a new application interface.