All ISTQB exams
Free CTAL-TA practice test: 30 questions with answers
30 original questions for Certified Tester Advanced Level Test Analyst (CTAL-TA) v4.0, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.
- Free questions
- 30
- Full bank
- 112 questions
- Real exam
- 45 questions, 120 min
- Passing score
- 51 of 78 points
All 30 CTAL-TA questions with answers
The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.
The Tasks of the Test Analyst in the Test Process (6 questions)
Question 1
A test analyst joins the refinement meetings of an agile team for the first time. Which benefit does this early involvement bring to the testing effort?
- AIt lets the test analyst find ambiguous requirements and missing acceptance criteria before code is written, when fixes are cheapest
- BIt removes the need for any test execution in later iterations, since the analysis is treated as a complete verification of the product
- CIt lets the test analyst write the production code so that the developers can concentrate on the testing tasks
- DIt fixes the release date for the product so that stakeholders can plan their marketing campaigns in advance
Show answer and explanationHide answer
Correct answer: AEarly involvement lets the test analyst find ambiguities and gaps before development, when defects are cheapest to fix. The other options are wrong: later test execution is still needed, the analyst does not take over production code, and testers do not set release dates.
Question 2
According to the ISTQB test process, which activity transforms the test basis into test conditions and test cases?
- ATest planning, which defines the objectives, scope, approach and resources for the whole test effort
- BTest monitoring and control, which compares actual progress with the planned progress of the test work
- CTest analysis and test design, which derive what to test and how to test it from the test basis
- DTest completion, which archives the test assets and writes the final test summary report
Show answer and explanationHide answer
Correct answer: CTest analysis and test design turn the test basis into test conditions and test cases. Planning, monitoring and control, and completion do not derive test conditions, so they are wrong.
Question 3
A test analyst receives a draft functional specification for review before development starts. Which two actions are typical tasks for the test analyst on this work product? (Choose two.)
- AWriting the production code that implements the behavior described in the specification
- BChecking whether each requirement is clear, unambiguous and testable
- CApproving the project budget that funds the test environments and the test tools
- DDeriving test conditions that can later be traced back to each requirement in the specification
- EMaking the final go or no-go decision for the release on behalf of the whole project
Show answer and explanationHide answer
Correct answer: B, DReviewing requirements for clarity and testability and deriving test conditions from them are typical test analyst tasks on a specification. Writing production code, approving budgets and making the release decision are outside the test analyst's role.
Question 4
A project follows the V-model. A test analyst wants to design tests that check the whole system against the system requirements specification. Which test level fits this purpose?
- AIntegration testing, which checks the interfaces between architectural elements
- BComponent testing, which checks individual modules against the detailed design
- CSystem testing, which checks the end-to-end system against the system requirements
- DMaintenance regression testing, which checks that existing functions still work after a change
Show answer and explanationHide answer
Correct answer: CIn the V-model, system testing is aligned with the system requirements specification and checks the complete system end to end. Component and integration testing are aligned with lower-level design, and maintenance regression testing is a test type for changes rather than the level matching the requirements.
Question 5
During backlog refinement, a test analyst notices that a user story's acceptance criteria say nothing about what the system must do when a payment times out. What should the test analyst do first?
- ARemove the story from the sprint, because testing cannot begin until the entire backlog has been fully specified
- BWrite a test that records whatever the system currently does on a timeout and treat that result as the expected result
- CImplement a timeout handler in the code and then report the change to the developers for review
- DRaise the gap with the product owner and business analyst so the expected behavior is agreed before testing starts
Show answer and explanationHide answer
Correct answer: DThe expected behavior for a timeout is missing, so the test analyst should raise it with the people who own the requirement. Recording current behavior as expected, writing code, or removing the story all skip agreeing the expected result.
Question 6
Why does a test analyst maintain traceability between test conditions and the requirements in the test basis?
- AIt lets the team see coverage gaps and which existing tests a requirement change would affect
- BIt shows that each requirement is correctly implemented, so the test execution phase can be shortened
- CIt makes the test cases update themselves automatically whenever the code changes, with no manual effort
- DIt allows developers to skip the code review step, because every requirement already has a linked test case in the suite
Show answer and explanationHide answer
Correct answer: ATraceability links test conditions to requirements, which reveals coverage gaps and the tests affected by a requirement change. It does not prove correctness, replace code reviews, or update tests automatically.
The Tasks of the Test Analyst in Risk-Based Testing (6 questions)
Question 7
A team holds a workshop to list the product risks of a new online banking app. The test analyst then gives each risk a likelihood and an impact rating. Which step of risk-based testing is this?
- ARisk monitoring, which tracks how the risk levels change through the project and reports the current status
- BTest completion, which summarizes the final risk status in the closing report for the stakeholders
- CRisk mitigation, which reduces the likelihood of failure by changing the design or code before testing begins
- DRisk assessment, which estimates the likelihood and impact of each identified risk to derive its risk level
Show answer and explanationHide answer
Correct answer: DAssigning likelihood and impact to identified risks is risk assessment, which produces the risk level. Monitoring, mitigation and completion reporting are other steps and do not assign these ratings.
Question 8
Which definition best describes a product risk in risk-based testing?
- AA problem with the project schedule, budget, staffing or supplier that could delay the delivery of the work
- BA defect that was already found and fixed in an earlier release of the same product
- CA potential problem that could affect the quality of the product, such as a failure in a critical function
- DA test case that fails because the test environment was not configured correctly before execution started
Show answer and explanationHide answer
Correct answer: CA product risk is a potential problem that affects product quality, such as a critical function failing. Schedule, budget and supplier problems are project risks, while a fixed defect or a misconfigured environment is not a risk to the product.
Question 9
A test analyst prepares a risk-based test plan for an insurance claims system. Which two activities belong to risk control? (Choose two.)
- AListing every risk that the stakeholders can think of during a brainstorming session
- BEstimating how likely each feature is to contain a serious defect before testing starts
- CSelecting test techniques and the depth of testing for each feature according to its risk level
- DOrdering the test cases so that the tests for the riskiest areas are executed first
- ERecording the initial likelihood and impact values for each risk item in the risk register
Show answer and explanationHide answer
Correct answer: C, DRisk control uses risk levels to decide techniques, depth and execution order, which mitigates the risk. Listing risks, estimating likelihood and recording impact values belong to risk identification and assessment.
Question 10
A test manager asks a test analyst how risk-based testing changes the plan for an e-commerce release. Which answer describes the approach best?
- AEvery feature receives the same number of test cases so that the coverage report looks balanced to the stakeholders
- BTesting is postponed until all defect reports are closed, so that the risk assessment uses the final results only
- CLow-risk features are removed from the plan entirely, so no test level in the project ever checks them
- DEffort and execution order focus on the highest-risk features, so that critical failures are found early
Show answer and explanationHide answer
Correct answer: DRisk-based testing directs effort and execution order toward the highest-risk features so critical failures surface early. Equal test counts ignore risk, removing low-risk features from all testing is not risk-based, and postponing testing until defects close does not use risk to plan.
Question 11
Which term describes the risk that remains after the planned testing and other mitigation activities have been completed?
- AProduct risk, which concerns the quality of the software itself and how it behaves when people use it
- BResidual risk, which remains after the planned testing and mitigation and is reported to stakeholders
- CDetected defect, which is a fault that test execution has already revealed in the software
- DProject risk, which concerns the schedule, budget, staffing or other resources of the work
Show answer and explanationHide answer
Correct answer: BResidual risk is the risk left after planned testing and mitigation, and it is reported so stakeholders can accept or act on it. Product and project risks are categories of risk, and a detected defect is a fault rather than a remaining risk.
Question 12
A product owner wants to skip testing of a rarely used reporting screen because few users open it. The test analyst points out that the screen produces regulatory reports. What is the best response?
- AAsk the stakeholders to reassess the impact, because the regulatory role raises the risk level despite low usage
- BAccept the decision and exclude the screen from testing, since usage frequency is the only factor that changes the risk
- CTest the screen only after release, so that real users can report any problem they find in the regulatory output
- DRemove the regulatory requirement from the risk register so the risk assessment matches the actual usage data
Show answer and explanationHide answer
Correct answer: AImpact matters as well as likelihood, so a low-usage screen that produces regulatory output can still carry a high risk level. Asking stakeholders to reassess is the right response, while excluding the screen, testing after release, or deleting the requirement ignores the impact.
Test Analysis and Test Design (6 questions)
Question 13
A form field accepts whole-number ages from 18 to 65. Which set of inputs forms one valid equivalence partition for this field?
- AOnly the two values 18 and 65, because they are the only inputs that sit on the edges of the valid range
- BOnly the value 30, because it is a typical input that represents the whole valid range for the field
- CAll negative integers, which form a valid partition because the system is expected to accept each of these values
- DAll integers from 18 to 65, because the system is expected to treat every value in this range the same way
Show answer and explanationHide answer
Correct answer: DAn equivalence partition is a set of values the system should treat the same way, so all integers from 18 to 65 form one valid partition. Edge values alone, a single typical value, and negative numbers (an invalid partition) do not form a valid partition of the field.
Question 14
A shipping form accepts package weights from 0.5 kg to 30 kg. A test analyst wants to apply boundary value analysis to this field. Which set of values should be tested?
- A0.5, 15.0 and 30.0 kg, covering the lower bound, a middle value and the upper bound of the range
- B0.0 and 35.0 kg, covering one value below the range and one value above it only
- C1.0, 10.0, 20.0 and 25.0 kg, covering typical weights that fall inside the valid range
- D0.4, 0.5, 0.6, 29.9, 30.0 and 30.1 kg, covering each boundary and the values just beside it
Show answer and explanationHide answer
Correct answer: DBoundary value analysis tests each boundary and the values immediately on either side of it, which matches the last option. The first option touches the boundaries but omits the values beside them, the second misses the boundaries, and the third tests typical values that are not boundaries.
Question 15
Which situation is the best fit for decision table testing?
- AA discount rule whose outcome depends on several conditions combined, such as membership level and order size
- BA first quick exploration of an unfamiliar screen to learn how it behaves, before any test conditions are designed
- CA fixed sequence of web pages that a user visits in order to reach the final confirmation page after checkout
- DA check that a single text field rejects any value that is longer than the maximum permitted length
Show answer and explanationHide answer
Correct answer: ADecision tables suit rules where several conditions combine to produce different actions, as in the discount rule. Exploration suits experience-based work, a page sequence suits flow or use case testing, and a single field length check suits boundary value analysis.
Question 16
A test analyst tests a support ticket that moves between the states Open, In Progress, Waiting for Customer and Closed. Which technique gives the best coverage of the allowed moves between these states?
- AState transition testing, which covers the valid transitions between states and checks that invalid ones are rejected
- BEquivalence partitioning, which groups the ticket priority values into classes that the system treats the same way
- CStatement coverage of the ticket module code, which measures how many lines of the module were executed by the tests
- DError guessing, which relies on the tester's past experience of where support tickets usually break in practice
Show answer and explanationHide answer
Correct answer: AState transition testing is designed for behavior that depends on states and the transitions between them, so it covers valid moves and checks invalid ones. Statement coverage, partitioning priority values and error guessing do not model the allowed moves between states.
Question 17
Which statement about exploratory testing is correct?
- AA technique in which every test case is written in full before any test is run, so that the coverage report looks complete to managers
- BAn experience-based approach in which the tester designs and runs tests at the same time, using each result to guide the next one
- CA method that follows a fixed script of expected results, which must be executed in order and cannot be changed during testing
- DA method that proves the software has no remaining defects, because it covers every possible combination of inputs
Show answer and explanationHide answer
Correct answer: BExploratory testing is experience-based: test design, execution and learning happen together, and each result guides the next test. Writing all tests before running any, following a fixed script, and claiming proof of no defects all describe other or incorrect approaches.
Question 18
A configuration screen has four independent settings, each with three possible values. Testing every combination would take too long. Which technique reduces the set of tests while still covering every pair of values?
- APairwise testing, which covers every pair of values from two settings using a reduced set of combinations
- BStatement testing, which executes every line of the screen's code at least once, regardless of the settings used
- CMonkey testing, which enters random input into the screen to see whether it crashes
- DRandom testing, which picks configurations at random with no coverage target until the time budget for testing runs out
Show answer and explanationHide answer
Correct answer: APairwise testing builds a reduced set of combinations in which every pair of values for any two settings appears at least once. Random and monkey testing have no systematic pair coverage, and statement testing checks code lines rather than setting combinations.
Test Quality Characteristics (6 questions)
Question 19
A test analyst checks that a tax calculation returns exactly the amount required by the rules for each set of inputs. Which quality sub-characteristic is being tested?
- ALearnability, which checks how quickly a new user can understand how to use the calculation feature
- BFunctional correctness, which checks that results are accurate to the degree of precision the requirements need
- CInstallability, which checks how reliably the product can be installed and removed on a target platform
- DCo-existence, which checks that the product works while sharing resources with other products on the same system
Show answer and explanationHide answer
Correct answer: BFunctional correctness is the degree to which results are accurate to the required precision, which is what the tax check tests. Learnability, co-existence and installability are other quality characteristics and do not describe checking the accuracy of results.
Question 20
A mobile banking app gives no clear recovery path when a user enters a wrong PIN several times. Which usability sub-characteristic is most directly affected?
- AInteroperability, which measures how well the app exchanges data with other banking systems and external services
- BReplaceability, which measures how easily the app can be swapped for another product that serves the same purpose
- CPerformance efficiency, which measures how quickly the login screen responds when many users log in at once
- DUser error protection, which protects users against making mistakes and limits the harm when they do
Show answer and explanationHide answer
Correct answer: DUser error protection covers how well the system protects users against making errors, and a PIN lockout with no clear recovery path weakens that protection. Interoperability, replaceability and performance efficiency describe other characteristics and do not concern error recovery.
Question 21
A product must share a computing environment with other products without harming them and must also exchange data with third-party systems. Which quality characteristic covers both needs?
- AUsability, which covers how easily users can learn, operate and protect themselves from errors in daily use
- BReliability, which covers how long the product runs without failure and how quickly it recovers after a failure
- CCompatibility, which covers sharing an environment with other products and exchanging information with other systems
- DFunctional suitability, which covers whether the product provides the functions that users need to do their tasks well
Show answer and explanationHide answer
Correct answer: CCompatibility includes co-existence, which is sharing an environment without harm, and interoperability, which is exchanging information with other systems. Usability, reliability and functional suitability are separate characteristics that do not cover both needs.
Question 22
Which two statements about compatibility testing are correct? (Choose two.)
- ACompatibility testing is the same as functional testing, because both check the expected results of each feature
- BCo-existence testing checks that the product works alongside other products that share the same environment and resources
- CCompatibility testing needs to be carried out only once, during the final release, and not in any later release
- DInteroperability testing checks that two or more systems can exchange information and use the information they receive
- ECompatibility testing covers only the browser version and never the operating system or the hardware platform
Show answer and explanationHide answer
Correct answer: B, DCo-existence and interoperability are the two sub-characteristics of compatibility, described in the second and fourth options. Compatibility is not the same as functional testing, it is needed in later releases too, and it also covers operating systems and hardware.
Question 23
A test analyst checks that the product can be installed and removed on a target platform by following the documented steps, and that a failed installation is rolled back cleanly. Which characteristic is being tested?
- ALearnability, which checks how easily new users can understand the main functions of the product after first use
- BInstallability, which checks that the product can be installed and uninstalled reliably in a specified environment
- CFunctional completeness, which checks that every function described in the requirements is present and available in the product
- DInteroperability, which checks that the product can exchange data correctly with other systems in the environment
Show answer and explanationHide answer
Correct answer: BInstallability is the degree to which a product can be installed and uninstalled successfully in a given environment, including a clean rollback. Learnability, interoperability and functional completeness are other characteristics and do not describe installation and removal.
Question 24
A test analyst plans a usability test for a new checkout flow. Which activity best supports this test?
- ARunning an automated script that measures the database response time for each payment request sent
- BCounting the lines of code in the checkout module to estimate the effort needed for future maintenance and refactoring work
- CObserving a group of representative users as they complete a purchase and recording where they hesitate or make errors
- DChecking that every field in the checkout form accepts only values of the correct data type
Show answer and explanationHide answer
Correct answer: CUsability testing observes representative users doing realistic tasks to find where they struggle. Code counts, response-time scripts and data type checks test other concerns such as maintenance, performance or input validation and do not reveal how users experience the checkout.
Software Defect Prevention (6 questions)
Question 25
Which practice is a defect prevention practice rather than a defect detection practice?
- AApplying a shared coding standard and checklists during development to avoid common mistakes before coding
- BRunning the regression test suite after every change to find any new failures in the existing functions
- CExecuting dynamic tests on the completed system to reveal failures that appear under realistic inputs and loads
- DLogging every failure found during system testing into the defect management tool with its severity
Show answer and explanationHide answer
Correct answer: ACoding standards and checklists applied during development stop common mistakes from being introduced, which is prevention. Regression runs, dynamic system tests and failure logging all detect defects that already exist.
Question 26
A defect in a requirement statement was introduced during requirements analysis but was found only during system testing. Which goal of phase containment was missed?
- AFinding the defect during the final acceptance test, so the customer sees it before go-live
- BFinding the defect in the phase where it was introduced, before it spreads into design and code
- CRecording the defect in the tool with a severity level that matches the number of affected users
- DExtending the test plan so that the system test team has a longer period for test execution and reporting work
Show answer and explanationHide answer
Correct answer: BPhase containment aims to find defects in the phase where they were introduced, so they do not spread into later work. Finding the defect at acceptance, recording its severity and extending the test plan do not contain it in its originating phase.
Question 27
After a release, a team finds that the same type of data-mapping defect has appeared in three consecutive projects. Which action best mitigates the recurrence of this defect type?
- AAsking testers to run more manual test cases on each release and hoping that they find the defect earlier
- BAnalysing the root cause of the pattern, then updating the mapping review checklist and development standards
- CFixing each reported instance individually and closing the defect reports, without recording the cause anywhere
- DFreezing all changes to the mapping code until the next major release, so the defect cannot be introduced again
Show answer and explanationHide answer
Correct answer: BRoot cause analysis of the pattern, followed by updates to checklists and standards, addresses why the defect keeps appearing. More manual testing finds it later rather than preventing it, freezing code is not a fix, and closing reports without a cause leaves the defect free to recur.
Question 28
Which two actions help mitigate the recurrence of defects over time? (Choose two.)
- ARecording the root cause of each significant defect in a defect taxonomy and reviewing the trends regularly
- BClosing defect reports as soon as the fix is merged, without analysing why the defect occurred in the first place
- CAssigning the blame for each defect to the individual developer so that the cause is avoided in future
- DFeeding the lessons learned in retrospectives into updated checklists, standards and training material
- EReducing the number of defect reports by removing the severity field from the defect management tool
Show answer and explanationHide answer
Correct answer: A, DRecording root causes in a taxonomy and feeding lessons learned into checklists and standards both change the process so defects are less likely to recur. Closing reports without analysis, blaming individuals and hiding severity data do not address the causes.
Question 29
A team introduces a checklist-based review of requirements before design starts. Which benefit does this practice primarily offer?
- ATesters no longer need to write test cases, because the review confirms that the software will be correct
- BThe development schedule becomes fixed, so the project manager can predict the exact delivery date with full confidence
- CAmbiguous or missing requirements are removed before design and code depend on them, so defects are not built in
- DEvery defect found later in testing is automatically assigned to the author of the requirement for correction
Show answer and explanationHide answer
Correct answer: CA requirements review removes ambiguity and gaps before design and code depend on them, which prevents defects from being built in. Reviews do not remove the need for test cases, fix the schedule, or assign later defects automatically.
Question 30
A team that keeps making the same API misuse errors runs short training sessions on the API contract and its common pitfalls before new work starts. Which category does this practice belong to?
- ADefect detection, because the training sessions find the misuse errors that are already present in the code and report them
- BTest execution, because the training sessions include running the existing test cases to show the failures to developers
- CTest completion, because the training sessions close the project's open defect reports before the release is approved
- DDefect prevention, because it reduces the chance that the same mistakes are made in the first place
Show answer and explanationHide answer
Correct answer: DTraining that targets known mistakes reduces the chance that they are made in the first place, which is defect prevention. The training does not detect existing defects, run tests, or complete the project's defect reports.