ISTQB Risk-Based Testing Strategies 5 — Questions and Answers
Question 1: According to ISTQB, which of the following BEST describes the relationship between risk level and test depth?
- Higher risk warrants shallower testing to save time for fixes
- Higher risk warrants deeper, more thorough testing to reduce residual risk (Correct answer)
- Risk level has no influence on test depth in a structured test process
- Lower risk areas should always receive the deepest testing to save high-risk areas for last
Correct answer: Higher risk warrants deeper, more thorough testing to reduce residual risk
ISTQB risk-based testing principles state that higher-risk items should receive more intensive testing — more test cases, more rigorous techniques, and earlier execution.
Question 2: A tester is applying risk-based testing and runs out of time before completing all planned tests. Which outcome is MOST likely compared to a non-risk-based approach?
- More critical defects will remain undetected because important tests were deferred
- The most important areas have been tested first, so the untested areas pose lower risk (Correct answer)
- The test coverage will be identical to a non-risk-based approach
- Risk-based testing always ensures 100% test execution regardless of time
Correct answer: The most important areas have been tested first, so the untested areas pose lower risk
By executing the highest-risk tests first, a risk-based approach ensures that if time is cut short, the remaining untested areas are lower risk and the most critical potential failures have been addressed.
Question 3: Which of the following is a valid input to the risk assessment process?
- Defect density metrics from previous similar projects (Correct answer)
- The current weather forecast
- The number of test environments available
- The version of the test management tool being used
Correct answer: Defect density metrics from previous similar projects
Historical defect data from similar projects is a valuable input to risk assessment, as it informs the likelihood that similar components or patterns will produce defects again.
Question 4: In ISTQB's risk-based approach, what is the role of 'risk monitoring' during test execution?
- To ensure all risk documentation is filed correctly
- To track whether risk levels change as testing progresses and defects are found or mitigated (Correct answer)
- To monitor the test team's productivity against the plan
- To verify that risk assessments were approved by management
Correct answer: To track whether risk levels change as testing progresses and defects are found or mitigated
Risk monitoring during test execution involves tracking changes in risk levels as defects are found and fixed, or as new risks emerge, so that priorities can be adjusted accordingly.
Question 5: Which ISTQB testing level is MOST commonly associated with product risk assessment targeting business-critical functionality?
- Unit testing
- Integration testing
- System testing
- Acceptance testing (Correct answer)
Correct answer: Acceptance testing
Acceptance testing, particularly user acceptance testing (UAT), is most closely associated with business-level product risk assessment since it validates the system against business needs and user expectations.
Question 6: A risk-based testing strategy recommends allocating 60% of testing effort to 20% of the system's features. This is MOST consistent with which principle?
- Test early and often principle
- Pareto principle applied to defect distribution and risk concentration (Correct answer)
- Exhaustive testing principle
- Pesticide paradox principle
Correct answer: Pareto principle applied to defect distribution and risk concentration
The Pareto principle (80/20 rule) suggests that a small proportion of features typically carries the majority of risk and defects, justifying concentrated effort on that subset.
Question 7: Which of the following is NOT a typical output of a risk analysis performed during test planning?
- A prioritized list of features by risk level
- Updated risk register with likelihood and impact ratings
- Test effort allocation proportional to risk exposure
- Detailed design specifications for the software architecture (Correct answer)
Correct answer: Detailed design specifications for the software architecture
Detailed design specifications are a development artifact, not an output of test risk analysis; risk analysis produces risk-ranked feature lists, updated risk registers, and test effort distributions.
ISTQB Risk-Based Testing Strategies 5
According to ISTQB, which of the following BEST describes the relationship between risk level and test depth?