CTFL-AcT Sample Questions Answers

Comprehensive Detailed Explanation (Approx. 200–220 words):

In the first BPMN diagram (Loan Request Process), the process starts with the receipt of a loan application. Then, parallel gateways (indicated by the “+” symbols) are used to trigger three separate evaluations: verifying employment, requesting and reviewing a credit record, and performing and reviewing a title search. These are executed concurrently, not sequentially.

After all checks are completed, the loan application is reviewed. A decision gateway (diamond with an “X”) checks whether the loan is approved. Depending on the decision:

If approved: a loan approval letter is sent, and a sub-process is triggered (represented by the rectangle with a "+" symbol inside), which is the creation of the loan contract. This is what identifies it as a BPMN “sub-process.”

If rejected: a rejection letter is sent.

In both cases, the process ends after customer notification.

Evaluation of answer options:

A: Incorrect — the verification steps occur before the loan status is determined.

B: Correct — the “Create the loan contract” activity has a “+” symbol, indicating a sub-process.

C: Incorrect — the parallel gateway means these tasks are executed concurrently, not sequentially.

D: Incorrect — all review activities are mandatory prior to application review.

Therefore, B is the correct answer.

Acceptance Test-Driven Development (ATDD) involves early collaboration between stakeholders to define acceptance criteria and tests before development begins. Using business process models in ATDD helps visualize user behavior, align test cases with real workflows, and serve as living documentation.

Option C is the least meaningful argument because:

Business process models abstractly describe workflows and decisions at a business level. While they help clarify requirements and detect requirement-related defects, they do not directly support detecting defects in the application code, which is typically the focus of unit and integration testing, not acceptance testing.

Let’s validate the other options:

A is a strong argument — process models clarify use cases for testers.

B is valid — graphical models help visualize test coverage directly.

D is true — as business process models evolve, they remain valuable artifacts aligned with current system behavior and requirements.

Answer: C. Business process models will make it easier to detect defects in the application code.

To determine the minimum number of test cases needed to cover:

All unique paths (without repeating loops) in the BPMN process model.

All decision rules (combinations) in the DMN decision table.

Let’s break it down:

BPMN Paths:

If the purchase order is not approved → process ends → 1 path

If approved:

Goods received → “Check of delivery” → Acceptance YES → Payment → 1 path

Goods received → “Check of delivery” → Acceptance NO → Discussion → End → 1 path

= Total distinct BPMN paths: 3

DMN Table:

There are 4 rules based on two inputs (Quality check and Quantity check):

Acceptable + Amount ok → Passed

Substandard + Amount ok → Failed

Acceptable + Amount incorrect → Failed

Substandard + Amount incorrect → Failed

You must execute 4 combinations to cover all decision rules.

To cover both all BPMN flows and all DMN rules, you need a minimum of 4 test cases (each using a different rule from the DMN table and associated BPMN path). Paths may overlap, but all rules must be exercised.

Gherkin is a structured language used in Behavior-Driven Development (BDD) to define test cases in a clear, business-readable format. It follows the GIVEN-WHEN-THEN structure:

GIVEN describes the precondition (system’s state before the action).

WHEN describes the action/event.

THEN describes the expected result or outcome.

Analyzing the phrases:

ii) “The elevator is on the Ground Floor” is a precondition — fits GIVEN.

i) “The total weight of passengers is greater than 200 kg” is an action or state change — fits WHEN.

vi) “A message ‘too many passengers’ is displayed on the screen” is the expected outcome — fits THEN.

Thus, Option A correctly maps these elements to form a well-structured Gherkin scenario.

Other options are incorrect because:

Option B misplaces an expected outcome as an action.

Option C misrepresents the order — “login” isn’t a precondition.

Option D introduces two THEN elements and violates the typical Gherkin structure.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2.2):

“Gherkin test cases use GIVEN-WHEN-THEN structures to make the behavior of the system under test understandable by all stakeholders.”

Comprehensive Detailed Explanation (Approx. 200–220 words):

This question focuses on the coverage criterion “execute all possible process tasks” from the BPMN model of a $100 withdrawal.

Let’s analyze the process:

The process starts when the user selects “Withdraw $100.”

A decision gateway checks if the balance is ≥ $100.

If NO: the card is removed and withdrawal is rejected.

If YES: the user is prompted to select whether they want a receipt.

Depending on the user’s choice:

If YES: the receipt is printed → then $100 is withdrawn → card is removed.

If NO: $100 is withdrawn → card is removed (no receipt printed).

To meet the criterion “execute all possible process tasks,” we must cover:

Rejected withdrawal path (balance < 100)

Withdrawal without receipt

Withdrawal with receipt

Receipt printing

Card removal in both success and failure

Test case coverage:

Test 1 (balance = $100, receipt = YES): covers successful withdrawal + receipt printed.

Test 3 (balance = $85): covers withdrawal rejected + card removed.

Together, these two tests execute all possible process tasks:

Withdraw with receipt

Reject due to insufficient balance

Receipt printed

Withdraw funds

Remove card

Other test combinations are redundant or do not add new path coverage.

Beta testing is conducted after internal development and testing activities have concluded. It serves as a last line of defense before release by involving real users in real-world usage. One of its primary purposes is to uncover defects, usability problems, or configuration issues that were not found during structured testing.

Option D is correct because it captures the essential role of beta testing — to identify issues in the field that may have slipped past internal test processes, including edge cases or environmental incompatibilities that were not part of the standard test environments.

Other options are incorrect:

Option A is incorrect — beta testing is not performed by developers, and usually not at the customer’s site under development supervision.

Option B is misleading — beta testing occurs late in the process, not “early in development.”

Option C is inaccurate — beta testing is not about defining acceptance criteria. Those should already be established. Beta testers validate the product against those criteria or their practical needs.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 3.2):

“Beta testing is performed by users and may identify defects or issues that were not found during internal testing due to differences in environments, workflows, or usage patterns.”

In ATDD (Acceptance Test-Driven Development), business process modeling (e.g., using BPMN) is a powerful way to visualize workflows and system behavior from the user's perspective. Testers can use these models to derive acceptance test cases by covering different business paths, including normal flows, alternate flows, and exception conditions.

Option A is correct because it reflects this practical usage: testers analyze the business process model and create test cases to ensure coverage of the different paths the system might take. This aligns acceptance testing directly with business logic and enhances traceability.

Other options:

B is partially valid but less direct; business analysts help define rules, but test case creation is a tester's role.

C reverses the correct flow; BPMN models are often created first and used to define or validate acceptance criteria, not the other way around.

D is incorrect — requirements/user stories are usually defined through stakeholder collaboration, not auto-generated from BPMN diagrams.

Answer: A. Testers use business process models to write test cases that cover the different paths.

When stakeholders provide conflicting acceptance criteria, resolving the conflict effectively requires focusing on the underlying business goals rather than getting stuck in technical or solution-level disagreements.

Option D is correct because it aligns with the core role of a business analyst and an acceptance tester: to understand and validate business needs. By exploring the root business objectives, you can help stakeholders reframe the problem and reach a compromise based on what delivers the most value.

Other options:

A may lead to confrontation and unproductive discussion without proper facilitation.

B is risky — prioritizing stakeholders may escalate conflict or appear biased.

C assumes you can objectively resolve the conflict based only on pros and cons, but without understanding the business context, the decision may not meet stakeholder needs.

Answer: D. Instead of discussing conflicting technical solutions, you try to understand the underlying business needs

Ensuring traceability between requirements (user stories) and test cases is a cornerstone of quality assurance in acceptance testing. It confirms that all business needs are covered by corresponding tests and helps assess the impact of changes. Traceability matrices or tools are used to track these links throughout the lifecycle.

Option B is correct because regularly verifying and updating traceability ensures that acceptance test coverage remains aligned with evolving requirements — a best practice in quality assurance.

Other options:

A (review of source code) is a white-box technique, more suitable for unit or integration testing.

C (checklist-based verification of requirements) is useful but focuses on requirement quality, not directly on testing activities.

D (eye tracking) is a usability evaluation technique and not standard for verifying test case feasibility.

Answer: B. Verification of the traceability between user stories and test cases to make sure it is up to date.

In cross-functional, globally distributed teams, establishing collaboration, communication, and trust is key. A workshop (even virtual) is a proven method for initiating alignment, especially when a new team member joins, and project coordination is weak.

Option A promotes transparency and collective understanding, crucial for building team cohesion.

Option B is too passive and one-directional. Long emails rarely solve coordination problems in Agile or collaborative contexts.

Option C is about tool setup, not team integration or communication — tools are supportive but not substitutes for human connection.

Option D is not efficient; traveling to meet each team member is impractical and doesn’t guarantee a shared team vision.

✔ Answer: A. You organize a workshop with all team members to establish common understanding and to lay the foundation for fruitful trusting collaboration.

Exploratory testing is an unscripted, experience-based testing technique where the tester learns about the system, designs tests, and executes them simultaneously. It is especially effective in Agile environments, where rapid feedback and creative exploration are valuable.

Option D is the least likely action because scripting automated test scripts is a structured activity that typically occurs after exploratory sessions or during more formal test phases. Exploratory testing emphasizes manual exploration, not automation scripting.

Other options:

A is part of the core purpose of exploratory testing — discovering the product.

B is relevant — defining a charter and discussing it with stakeholders (like the Product Owner) helps guide the exploratory session.

C is also relevant — results of exploratory tests should be documented and communicated.

Answer: D. Scripting of the automated test scripts

User Experience (UX) requirement analysis is a critical component of acceptance testing and product development. According to ISTQB Acceptance Testing syllabus and industry-aligned UX design methodologies (e.g., ISO 9241-210 and BABOK guidelines), UX requirement analysis is typically structured around the following pillars:

User Analysis – Understanding who the users are (roles, goals, experience levels)

Task Analysis – Understanding what users do (tasks, workflows, pain points)

Context Analysis – Understanding where and how users interact with the product (environmental and contextual factors)

Competitor Analysis – Understanding how similar problems are solved in the market

Option B best describes Task Analysis, one of the most practical and impactful pillars. In task analysis, business analysts and UX researchers observe how users interact with current or comparable systems to understand workflow patterns, user frustrations, needs, and required system functionality. This method helps uncover implicit needs that users may not articulate in interviews.

This approach is aligned with ISTQB’s emphasis on understanding real-world usage and business processes as a foundation for deriving acceptance criteria and tests. It supports the creation of realistic scenarios that reflect actual user behavior, which is essential for verifying system fitness for use.

The other options are inaccurate:

A refers to psychological disposition, which is more aligned with user profiling or persona development, not a core focus of user analysis in requirement engineering.

C incorrectly ties context analysis with deriving security requirements, which is not its purpose.

D describes an unrealistic or incorrect method for competitor analysis.

Therefore, Option B is the best description of a key pillar of UX requirement analysis per industry and ISTQB standards.

Acceptance criteria describe what the system must do to fulfill a requirement from the user or business perspective. They must be observable, testable, and relevant to the business outcome or expected behavior.

In this scenario, the user story is about monitoring blood pressure and receiving alerts for excessive pressure. The acceptance criteria should focus on system behavior, thresholds, and how alerts are triggered based on user settings.

Option D is not a good acceptance criterion because:

It specifies a technical implementation detail (JavaScript framework), which is not the concern of acceptance testing.

Acceptance criteria should not prescribe how the system is built, but what it must do from a business or user point of view.

Other options (A, B, and C) all reflect testable and behavior-focused outcomes linked to the user story’s goal.

Answer: D. The system should be developed using JavaScript framework to allow fast response times

Performance testing evaluates how a system behaves under specific conditions, including load, stress, and endurance. Stress testing, in particular, involves pushing the system beyond its normal operational limits to identify breaking points.

Option B is correct because it describes a classic stress testing scenario: simulating users executing memory-intensive operations to evaluate system resilience and resource management.

Other options:

A describes usage profiles but is more aligned with load testing or configuration testing.

C refers to functional coverage, not performance-specific concerns.

D describes fuzz testing, which is used more for security or robustness testing than performance evaluation.

Answer: B. The system is stressed by simulating various users that perform memory-intensive tasks

UX task analysis focuses on understanding how users perform their tasks in real-world contexts. It captures not only the sequence of actions but also the surrounding environment — including physical conditions (light, noise), devices used, interruptions, and constraints. These external or environmental conditions become vital inputs to UX design decisions, helping teams adapt interfaces and workflows to user realities.

Option C is correct because it emphasizes this key aspect of UX task analysis: capturing external conditions that influence usability and system interaction.

Other options:

A focuses on user profiling, not task analysis.

B refers to business process modeling, which is more strategic and less user-context specific.

D refers to benchmarking or inspiration analysis — useful for design ideation but not task analysis.

Answer: C. External conditions are considered as input for subsequent design steps.

ISO/IEC 25010 defines two key quality models:

Product Quality Model (e.g., Usability, Security, Portability)

Quality in Use Model — which includes characteristics of the user’s experience when interacting with the product in a real-world context.

The four main characteristics of the Quality in Use model are:

Effectiveness

Efficiency

Satisfaction

Freedom from risk

Option A — Efficiency is one of the key Quality in Use characteristics, as it refers to the resources used to achieve goals with accuracy and completeness.

Other options:

B (Usability), C (Compatibility), and D (Portability) are characteristics of the Product Quality Model, not of Quality in Use.

Therefore, the correct answer, as per ISO 25010:2011, is:

Answer: A. Efficiency

Model-Based Testing (MBT) is a test design technique in which test cases are derived from a model that describes some aspects of the system’s behavior. In the context of acceptance testing, MBT can be used to generate high-level acceptance test cases automatically from business process models, use case diagrams, state models, or decision tables.

Option A is correct because MBT supports the systematic generation of acceptance test cases from these models, enabling better coverage of business rules and workflows while maintaining traceability to the requirements.

Other options:

B is close but slightly off: prioritization of acceptance tests in a priority-based approach depends on business value or stakeholder-defined priorities, not strictly on product risks.

C is incorrect. Risk-based testing relies on structured risk assessment, not just intuition or experience.

D is false. Black-box testing focuses on inputs and outputs without referencing the internal structure (such as function calls), which is characteristic of white-box testing.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.3):

“Model-based testing can be used to generate acceptance test cases systematically based on models representing business processes or system behavior.”

Acceptance criteria describe the conditions under which a requirement or user story is considered fulfilled. These criteria serve as the basis for deriving acceptance test cases. To transform them into concrete tests, testers apply test design techniques such as:

Business process-based testing (deriving tests from modeled workflows)

Use case testing (based on user interactions with the system)

Option B is correct because it clearly describes how structured techniques are applied to translate acceptance criteria into actionable test cases, ensuring traceability and relevance.

Other options:

A is incorrect — experience-based techniques may supplement, but structured methods are foundational in deriving test cases from defined criteria.

C is misleading — risk-based testing is a well-established and effective practice for prioritizing test efforts, including acceptance testing.

D is incorrect — both functional and non-functional criteria are important; there’s no fixed rule to prioritize one over the other.

Answer: B. Test techniques such as business process-based testing or use case testing can be used to create acceptance tests from the acceptance criteria

An exploratory test charter is a high-level plan or mission statement for a time-boxed exploratory testing session. It guides what the tester should focus on during the session and may include the goal of the test, specific areas of the system under test, the risk or feature to explore, the type of persona to simulate (e.g., novice or expert user), and possibly known issues to watch out for.

Option A is correct because specifying a user persona (such as a novice user) helps the tester approach the system from that perspective. This supports the goal of exploratory testing: to simulate realistic usage and uncover issues that scripted tests might miss.

Option B is incorrect — although exploratory testing is adaptive, the charter is defined before the session starts, not elaborated during execution.

Option C is misleading — charters may refer to areas of interest, but not necessarily to a predefined list of activities.

Option D is incorrect — a test oracle (i.e., the mechanism for determining whether a result is correct) is not defined by the charter. It may exist already or be inferred from requirements, heuristics, or user expectations.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 3.1):

“Charters define the focus of exploratory testing sessions and may specify the tester’s role or perspective (e.g., novice user).”

Security testing ensures the system protects data and maintains intended behavior under potential attacks. Different techniques address specific security goals.

Option A is correct: Static vulnerability analysis inspects code or architecture without executing it, identifying weaknesses in mechanisms such as authentication (e.g., login controls) and authorization (e.g., access permissions). These mechanisms are foundational security requirements.

Other options:

B is misleading — penetration testing simulates attacks, but input validation is more often verified with fuzzing or code review.

C is incorrect — fuzzing tests input handling, not the performance of cryptographic algorithms.

D is incorrect — threat modeling is a design-time activity to identify risks; it’s not used to test policies directly.

Answer: A. Static vulnerability analysis to test authentication and authorization mechanisms

ATDD and BDD are agile development approaches that emphasize collaboration among stakeholders (such as business analysts, developers, testers, and customers) to define clear and testable acceptance criteria before or as requirements are being finalized. Both techniques promote using concrete examples to drive development and validate understanding.

In ATDD, acceptance test cases are derived directly from user stories or requirements and written before the actual implementation starts. In BDD, scenarios are expressed in natural language (often using Gherkin syntax) to describe behaviors the system should exhibit under specific conditions. In both cases, these tests serve not only as validation tools but also as executable specifications — i.e., shared understanding expressed through concrete examples.

Option B is correct because both methodologies use examples (scenarios/test cases) to describe how a system should behave — serving as acceptance criteria.

Incorrect options:

Option A wrongly suggests BDD defers testing until after requirements are finalized — it actually promotes early collaboration.

Option C is false — in ATDD, test cases are based on predefined acceptance criteria, not written beforehand.

Option D is inaccurate — acceptance tests in ATDD and BDD may be automated but are collaboratively written first, not by test automation engineers alone.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2):

“Both ATDD and BDD involve the collaborative definition of test cases before implementation to clarify requirements and serve as product usage examples.”