Software Testing Risk Assessment & Management 2 — Questions and Answers
Question 1: Which risk metric is calculated by multiplying the probability of a defect escaping to production by the cost of fixing it post-release?
- Risk exposure (Correct answer)
- Risk velocity
- Risk appetite
- Risk tolerance
Correct answer: Risk exposure
Risk exposure = probability × impact, giving a monetary or weighted measure of expected loss.
Question 2: During risk-based testing, a module has HIGH consequence but LOW likelihood. Which priority level should it receive?
- Low
- Medium (Correct answer)
- High
- Critical
Correct answer: Medium
High consequence combined with low likelihood typically places a risk in the medium priority band on a risk matrix.
Question 3: A tester identifies a risk that is outside the project scope to mitigate. What is the correct response strategy?
- Avoid the risk
- Transfer the risk
- Accept the risk (Correct answer)
- Reduce the risk
Correct answer: Accept the risk
When mitigation is outside scope, the project formally accepts the risk and documents it in the risk register.
Question 4: What does 'residual risk' mean in a software testing context?
- Risk that was discovered after product release
- Risk remaining after mitigation actions have been applied (Correct answer)
- Risk introduced by new requirements
- Risk carried over from a previous sprint
Correct answer: Risk remaining after mitigation actions have been applied
Residual risk is the level of risk that remains after all planned risk responses and controls have been implemented.
Question 5: Which technique uses structured brainstorming guided by category prompts (e.g., People, Process, Technology) to identify software risks?
- Fault tree analysis
- SWOT analysis
- Ishikawa (fishbone) diagram (Correct answer)
- Risk checklists
Correct answer: Ishikawa (fishbone) diagram
The Ishikawa diagram organizes potential causes of failure into branches that map to risk categories like process or technology.
Question 6: A QA manager decides to purchase cyber-liability insurance to cover the cost of a data-breach defect reaching production. This is an example of which risk response?
- Avoidance
- Mitigation
- Transfer (Correct answer)
- Acceptance
Correct answer: Transfer
Purchasing insurance shifts the financial consequence of a risk to a third party, which is risk transfer.
Question 7: In IEEE 829, which document is primarily responsible for capturing identified risks and their planned responses before testing begins?
- Test summary report
- Test plan (Correct answer)
- Test case specification
- Incident report
Correct answer: Test plan
The IEEE 829 test plan includes a risk section that lists identified risks, their likelihood, impact, and mitigation strategies.
Software Testing Risk Assessment & Management 2
Which risk metric is calculated by multiplying the probability of a defect escaping to production by the cost of fixing it post-release?