All ISTQB exams
Free CTFL practice test: 30 questions with answers
30 original questions for Certified Tester Foundation Level (CTFL) v4.0, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.
- Free questions
- 30
- Full bank
- 112 questions
- Real exam
- 40 questions, 60 min
- Passing score
- 26 of 40 points (65%)
All 30 CTFL questions with answers
The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.
Fundamentals of Testing (5 questions)
Question 1
A product owner reviews a test summary showing 2,000 test cases executed in the final cycle with no failures. The product owner concludes that the release is defect-free. Which testing principle best explains why this conclusion is not justified?
- ATesting can show that defects are present but cannot prove that none remain
- BExhaustive testing is required before any release decision can be made safely
- CDefects tend to cluster in a few modules, so the rest of the product is safe
- DPassing tests prove that every requirement was implemented exactly as the customer intended
Show answer and explanationHide answer
Correct answer: AThe principle that testing shows the presence of defects, not their absence, means a clean test run lowers risk without proving the product is defect-free. Exhaustive testing is impossible in practice, defect clustering does not make the rest of the product safe, and passing tests do not prove every requirement is met.
Question 2
Which statement correctly describes the relationship between an error, a defect and a failure?
- AA failure is the mistake a developer makes while writing code, which introduces a defect into the software
- BA defect is the incorrect behaviour a user observes when the software runs in production
- CA human error can introduce a defect into a work product, and executing that defect can cause a failure
- DA failure is always caused by a problem in the test environment rather than in the software under test
Show answer and explanationHide answer
Correct answer: CA human error leads to a defect in a work product, and when that defect is executed under the right conditions it can cause a failure. The other options swap the terms or wrongly attribute failures to the test environment.
Question 3
A colleague argues that testing and debugging are the same activity because both involve finding problems in the code. Which response best clarifies the difference?
- ATesting locates the root cause of a defect in the code, while debugging records failures so they can be analysed later
- BDebugging is carried out after release, while testing is carried out only during the design phase
- CTesting and debugging differ only in who performs them, since testers do testing and developers do debugging
- DTesting reveals failures caused by defects, while debugging finds and fixes the defect that caused them
Show answer and explanationHide answer
Correct answer: DTesting reveals failures that come from defects, whereas debugging is a development activity that locates and fixes the defect behind a failure. The first option reverses the two roles, the second gets the timing wrong, and the third misses that the two activities differ in purpose.
Question 4
Which statement about testware is correct?
- ATestware refers only to the automated scripts that the automation team stores in a version control repository for later runs
- BTestware is the set of user requirements that testers receive before any test planning starts
- CTestware is the software product itself, which the test team modifies to make the tests pass
- DTestware includes test cases, test data, test scripts and test environment items created for testing activities
Show answer and explanationHide answer
Correct answer: DTestware is all the artifacts produced for testing, such as test cases, test data, scripts and environment items. The other options limit testware to scripts, confuse it with the test basis, or wrongly describe the product under test as testware.
Question 5
Which two statements explain why testing is necessary in software development? (Choose two.)
- ATesting reduces the risk of failures reaching users after release
- BTesting guarantees that the software will contain zero defects after release
- CTesting removes the need for requirements analysis and design reviews
- DTesting gives stakeholders information to support decisions about release readiness
- ETesting replaces static analysis, because running the code reveals every coding standard violation
Show answer and explanationHide answer
Correct answer: A, DTesting reduces the risk of failures in production and provides information that stakeholders use to decide whether a release is ready. It cannot guarantee zero defects, and it does not replace requirements analysis, reviews or static analysis.
Testing Throughout the Software Development Lifecycle (5 questions)
Question 6
A V-model project finds that interface defects between two components are only discovered during system testing, when fixes are expensive. Which change best applies the shift-left principle?
- APostpone system testing until acceptance testers have signed off the design documents
- BRemove integration testing so that system testing has more time to find interface defects
- CDelay all test planning until the code freeze so that testers can work only from the final build and final documentation
- DStart integration testing as soon as components are available and involve testers in design reviews
Show answer and explanationHide answer
Correct answer: DShift-left moves testing activities earlier, so integration testing starts as components become available and testers take part in reviews that catch interface problems sooner. Postponing or removing testing, or delaying planning until code freeze, does not make defects cheaper to find.
Question 7
Which test level focuses on verifying an individual module or class in isolation from the rest of the system?
- AComponent testing of an individual module or class
- BSystem testing of the complete end-to-end application
- COperational acceptance testing by the operations team
- DIntegration testing of the interfaces between two modules
Show answer and explanationHide answer
Correct answer: AComponent testing, also called unit testing, checks individual modules or classes in isolation, often with stubs or drivers standing in for missing parts. The other options describe levels that work on the whole system, its operational readiness or the interaction between parts.
Question 8
After a defect in the interest calculation is fixed, a tester first reruns the test case that originally exposed the defect, then reruns the existing tests for other interest features to check for side effects. Which test types have been applied, in that order?
- AAcceptance testing followed by smoke testing
- BConfirmation testing followed by regression testing
- CExploratory testing of the new feature followed by usability testing of the user screens
- DStatic testing followed by performance testing
Show answer and explanationHide answer
Correct answer: BConfirmation testing reruns the failed test to verify that the fix works, and regression testing reruns other tests to detect unintended side effects. The other combinations describe test types that do not verify a specific fix and its side effects in that order.
Question 9
Which situation is a trigger for maintenance testing?
- ARetiring an existing system and migrating its data to a new platform
- BWriting the test strategy for a project that has not started yet
- CBuilding a new product that has never been released to any users
- DGathering initial stakeholder requirements for a new system before design begins
Show answer and explanationHide answer
Correct answer: AMaintenance testing is triggered by modifications, migrations and retirement of a system that is already in use. The other options describe new development or planning work that happens before any change to an operational system.
Question 10
Which two statements about test types are correct? (Choose two.)
- ANon-functional testing evaluates qualities such as performance, usability and security
- BFunctional testing is performed only during acceptance testing, never earlier in the lifecycle
- CWhite-box testing derives tests from the functional specification rather than the code structure
- DConfirmation testing checks that a previously failed test now passes after a defect fix
- EChange-related testing is limited to exploratory sessions carried out after the product is released
Show answer and explanationHide answer
Correct answer: A, DNon-functional testing covers quality characteristics such as performance and usability, and confirmation testing reruns a failed test after a fix. Functional testing occurs at many levels, white-box testing is based on code structure, and change-related testing is not limited to post-release sessions.
Static Testing (5 questions)
Question 11
Which statement best describes the difference between static testing and dynamic testing?
- AStatic testing needs a running test environment, while dynamic testing reviews documents and requirements only
- BBoth static and dynamic testing require test data and a configured environment before they can begin
- CStatic testing examines work products without running them, while dynamic testing runs the software
- DStatic testing finds failures in running systems, while dynamic testing finds defects in documents
Show answer and explanationHide answer
Correct answer: CStatic testing reviews work products such as requirements and code without executing them, whereas dynamic testing runs the software and observes its behaviour. The other options reverse the two definitions or wrongly claim that static testing needs an execution environment.
Question 12
A regulated project needs a review of a safety-critical design specification. The review must follow a defined procedure with assigned roles and entry and exit criteria, and it must collect data to improve the review process. Which review type is most appropriate?
- AInformal review, which is performed quickly with little or no documented procedure and no defined roles
- BAd hoc discussion of the design by email between the architect and a single reviewer
- CWalkthrough, which is led by the author to explain the document to participants
- DInspection, which follows a defined process with roles, entry and exit criteria and metrics
Show answer and explanationHide answer
Correct answer: DAn inspection is the most formal review type, with defined roles, entry and exit criteria, and metrics used to improve the process. Informal reviews and walkthroughs use far less structure, and an email exchange between two people is not a formal review.
Question 13
In a formal review meeting, which role is responsible for recording the anomalies, decisions and action items that are raised?
- AModerator, who leads the meeting and ensures the review procedure is followed
- BAuthor, who revises the work product after the review and answers questions raised by each reviewer
- CScribe, who documents all anomalies, decisions and action items during the meeting
- DReviewer, who examines the work product before the meeting and reports defects found
Show answer and explanationHide answer
Correct answer: CThe scribe, also called the recorder, documents anomalies, decisions and action items during the review meeting. The moderator leads the meeting, the author revises the work product, and reviewers examine it and report findings.
Question 14
A static analysis tool reports that a local variable is declared and assigned but never read anywhere in a function. A developer asks what this finding means. Which answer is most accurate?
- AIt proves that the program will crash at runtime whenever the affected function is called
- BA code quality finding detected without running the program, which may indicate unused or dead code
- CIt is a dynamic failure that must be reproduced by a tester before the code can be changed
- DIt is a requirements defect, because the variable was not described in the detailed functional specification document
Show answer and explanationHide answer
Correct answer: BStatic analysis detects issues such as unused variables without executing the program, and such findings can indicate dead code or a quality concern. The other options wrongly claim a certain crash, a dynamic failure or a requirements defect.
Question 15
Which two benefits are typically provided by static testing? (Choose two.)
- AFinds defects early, before the code is executed
- BMeasures the response time of the application under a heavy user load
- CIdentifies deviations from coding standards and common programming errors
- DConfirms the application behaves correctly on every supported hardware platform
- EProvides production usage statistics showing which features users prefer
Show answer and explanationHide answer
Correct answer: A, CStatic testing finds defects early, before code is executed, and it can detect deviations from coding standards. Measuring response time under load and confirming platform behaviour require dynamic testing, and usage statistics come from production monitoring.
Test Analysis and Design (5 questions)
Question 16
A field accepts applicant ages from 18 to 65 inclusive. Which set of test values applies boundary value analysis most directly?
- A0, 18, 65 and 100
- B18, 30 and 65 as typical valid ages
- C17, 18, 65 and 66
- D5, 25, 45 and 85 spread evenly across the range
Show answer and explanationHide answer
Correct answer: CBoundary value analysis tests the values at each edge of a partition and just outside it, here 17 and 66 as invalid and 18 and 65 as valid. Typical values, evenly spread values and arbitrary extremes such as 0 and 100 do not focus on the boundaries.
Question 17
Which black-box technique is most suitable for testing business rules where different combinations of conditions produce different actions?
- ADecision table testing, which maps each combination of conditions to the expected actions
- BStatement testing, which executes each statement at least once
- CState transition testing, which models valid and invalid changes between system states using a state diagram or table
- DError guessing, which relies on the tester's experience of likely defect locations
Show answer and explanationHide answer
Correct answer: ADecision table testing covers combinations of conditions and their resulting actions, which suits complex business rules. Statement testing is a white-box technique, state transition testing suits systems that move between states, and error guessing depends on experience rather than a combination table.
Question 18
Which two statements about white-box testing are correct? (Choose two.)
- ADecision testing exercises each outcome, true or false, of a decision in the code
- BWhite-box techniques derive tests from the requirements specification rather than from the code
- CStatement coverage confirms that every decision outcome has been exercised at least once
- DAchieving full decision coverage also means that full statement coverage has been achieved
- EWhite-box tests can be designed without any access to the source code or program structure
Show answer and explanationHide answer
Correct answer: A, DDecision testing exercises both outcomes of each decision, and full decision coverage implies full statement coverage. Statement coverage does not check decision outcomes, and white-box tests rely on the code structure rather than being designed without it.
Question 19
An experienced tester who has worked on card payment systems expects users to enter expired cards, negative amounts and duplicate submissions. The tester designs tests for these cases without a formal specification. Which technique is being applied?
- ABoundary value analysis, which tests values at and near the edges of input partitions
- BError guessing, which uses the tester's experience to anticipate likely defects
- CUse case testing, which derives scenarios from actor and system interactions
- DEquivalence partitioning, which groups inputs into classes expected to behave alike
Show answer and explanationHide answer
Correct answer: BError guessing is an experience-based technique in which testers anticipate likely defects, such as expired cards or negative amounts, from past knowledge. The other options are specification-based techniques that derive tests from input edges, interactions or partitions rather than experience.
Question 20
A parcel form accepts weights from 0.5 kg to 30 kg inclusive. The tester wants one representative value for each equivalence partition, covering invalid and valid classes. Which set of values fits best?
- A5 kg, 15 kg and 25 kg, all spread evenly within the valid range
- BNegative weights, text entries and very large values such as 10,000 kg chosen at random
- C0.2 kg, 10 kg and 35 kg, one value from each invalid and valid class
- D0.2 kg and 35 kg only, covering both invalid classes but not the valid class
Show answer and explanationHide answer
Correct answer: CEquivalence partitioning needs one representative value from each valid and invalid class, so 0.2 kg covers the low invalid class, 10 kg the valid class and 35 kg the high invalid class. The other sets miss a class, cover only valid values, or use values that do not represent the stated partitions.
Managing the Test Activities (5 questions)
Question 21
A test manager has limited time before a release. The payment module has high business impact and changes every sprint, while the help pages have low impact and rarely change. Which test planning decision best applies risk-based testing?
- ASpread the test effort evenly across all modules so that no area is neglected
- BTest the help pages first because their tests are quicker to execute and report
- CSkip the payment module tests this sprint because the module was already tested in the previous release and is assumed to work
- DAllocate most test effort to the payment module, which has higher likelihood and impact of failure
Show answer and explanationHide answer
Correct answer: DRisk-based testing focuses effort where the likelihood and impact of failure are highest, and frequent change raises the likelihood. Spreading effort evenly, testing easy areas first, or skipping a frequently changed high-impact module ignores that risk.
Question 22
A test manager learns that the vendor may deliver the test environment two weeks late, which would push back the test schedule. How should this item be classified?
- AProduct risk, because it affects the quality of the software that is delivered
- BProject risk, because it threatens the schedule and the success of the project
- CResidual risk, because it remains after all planned mitigation measures have been applied
- DNot a risk, because scheduling items do not affect the quality of the tested product
Show answer and explanationHide answer
Correct answer: BA late test environment is a project risk because it threatens the schedule and project success rather than the quality of the product. Product risk concerns the quality of delivered software, and residual risk describes what remains after mitigation; calling it not a risk ignores its schedule impact.
Question 23
Halfway through test execution, the test manager sees that progress is behind schedule and most testers' time is going to low-priority cases. Which action is an example of test control?
- ACollecting the number of executed tests and open defects for the weekly status report to management
- BArchiving the testware and recording lessons learned at the end of the test project
- CReprioritising the remaining tests and reallocating testers to the highest-risk areas
- DWriting the test strategy and estimating effort for the next release cycle
Show answer and explanationHide answer
Correct answer: CTest control means taking corrective action when progress deviates from the plan, such as reprioritising tests and reallocating people. Collecting status data is test monitoring, archiving testware is test completion, and writing a strategy is test planning.
Question 24
A test team must know which version of a test script was run against which build of the application when a defect was reported. Which activity addresses this need?
- AConfiguration management, which controls and identifies versions of test items and testware
- BRisk management, which ranks the likelihood and impact of threats to the project
- CTest estimation, which predicts the effort needed for the planned test activities in each release cycle
- DDefect triage, which decides which reported defects are fixed in the next release
Show answer and explanationHide answer
Correct answer: AConfiguration management identifies and controls versions of the test items and testware so that results can be traced to exact versions. Risk management, test estimation and defect triage address other activities and do not record which versions were tested.
Question 25
A tester files a defect report that says only: login is broken, please fix urgently. The developer cannot reproduce the problem. Which information is most important to add?
- ANumbered steps to reproduce, with the expected result and the actual result observed
- BAn estimate of the total cost of the defect in staff hours and licence fees
- CA suggested code change to the authentication function written by the tester
- DA complete list of every stakeholder group who may be affected by the login problem over time
Show answer and explanationHide answer
Correct answer: AA defect report must let others reproduce the failure, so numbered steps with expected and actual results are essential. Stakeholder lists, cost estimates and proposed code changes may be useful later but do not help reproduce the problem.
Test Tools (5 questions)
Question 26
A team plans to automate the regression suite for a web application that receives frequent releases. Which benefit is most likely to be realised?
- AFull replacement of exploratory testing, since scripts can find unexpected defects
- BA guarantee that all defects in the application will be detected automatically
- CFaster and more consistent repetition of regression checks across releases
- DNo further maintenance, because automated scripts do not need updates after a release
Show answer and explanationHide answer
Correct answer: CTest automation is most valuable for repetitive regression checks, which it runs faster and more consistently. It does not replace exploratory testing or guarantee detection of all defects, and scripts still need maintenance when the application changes.
Question 27
A team runs its automated regression suite every night and reviews the pass/fail history and trends for each build on a dashboard. Which benefit of test automation does this mainly illustrate?
- AElimination of the need for any human analysis of failed tests, since the tool diagnoses root causes
- BEasier access to test information, such as statistics and trends, supporting objective assessment of quality
- CGuaranteed detection of all regression defects, because the same scripts are run for every build
- DRemoval of the need to keep the scripts aligned with the application, since results are stored automatically
Show answer and explanationHide answer
Correct answer: BAutomation makes information about testing, such as results history, statistics and trends, easy to obtain and supports objective assessment. Failed tests still need human analysis, no suite guarantees detection of all defects, and scripts still need maintenance when the application changes.
Question 28
A team automates tests for a feature whose requirements change almost every week. After three months, the team spends more time repairing scripts than running them. Which risk of test automation has materialised?
- AThe automation tool will rewrite the requirements so that the scripts continue to pass
- BMaintenance effort for automated scripts that exceeds the benefit gained from running them
- CAutomated tests will run without failures because they never check the feature
- DManual test design skills become unnecessary, since the automation tool can derive all test cases from the code itself
Show answer and explanationHide answer
Correct answer: BFragile scripts for a frequently changing feature can make maintenance cost more than the benefit, a well-known automation risk. Tools do not rewrite requirements or remove the need for test design skills, and scripts that never check anything give false confidence rather than a maintenance problem.
Question 29
Which description best matches keyword-driven test automation?
- ATester actions are recorded while using the application, then replayed exactly as captured
- BTest inputs are stored in a spreadsheet, and one script is run repeatedly with each row of data
- CTest cases are generated automatically from the source code by a static analysis tool
- DTest steps are written as keywords in a table, and each keyword maps to reusable code
Show answer and explanationHide answer
Correct answer: DKeyword-driven automation describes test steps as keywords in tables, with reusable implementation code behind each keyword. Capture-replay records and plays back user actions, data-driven automation varies only the input data, and generating tests from code is not keyword-driven automation.
Question 30
A tester needs thousands of realistic but fictitious customer records to test a billing module without using real personal data. Which tool type is most suitable?
- ADefect tracking tool that records the status of each reported billing failure
- BModel-based testing tool that generates test paths from a state diagram of the billing process
- CTest data preparation tool that generates realistic, anonymised records for test environments
- DStatic analysis tool that checks the billing code against the team's coding standard and flags unused variables
Show answer and explanationHide answer
Correct answer: CA test data preparation tool generates realistic, anonymised or synthetic data so that real personal data is not needed. Model-based testing tools generate test paths, defect tracking tools record failures, and static analysis tools inspect code rather than produce data.