CTFL-AcT Questions and Answers

In BDD (Behavior-Driven Development) and ATDD (Acceptance Test-Driven Development), “living documentation” refers to executable acceptance criteria that are kept up to date throughout development. These acceptance tests are written in natural, structured language (like Gherkin's Given-When-Then) and are linked directly to business requirements.

Option A is correct — “living documentation” bridges the gap between business and development by keeping requirements executable, relevant, and up to date.

Other options:

B is misleading — visual ATDD may use process models, but this is not a defining characteristic of BDD or ATDD.

C is true in part — BDD scenarios often use Given-When-Then, but this by itself is not the most defining statement when comparing options.

D is incorrect — ATDD and BDD support collaboration, but they do not expect business analysts to write code or automation scripts.

Answer: A. The concept of "living documentation" means that business requirements become executable

Clear, complete, and testable requirements or user stories are critical for effective acceptance testing. Ambiguities or vague statements lead to differing interpretations by stakeholders, developers, and testers. This often results in software that doesn’t meet user expectations or in tests that fail to verify business needs correctly.

Option B is correct because it highlights the importance of precise requirements in both implementation and testing phases. Ambiguities can result in incorrect behavior, untestable features, or test cases that don’t align with business goals.

Other options:

A is risky — while testers may explore assumptions during exploratory testing, relying on assumptions rather than clarification increases risk.

C is incorrect — the INVEST mnemonic helps write better user stories, but it doesn’t replace review or validation processes.

D is false — Agile still values requirements engineering; it’s more collaborative and incremental, with the product owner playing a key role, not diminishing its importance.

Answer: B. Vague or ambiguous requirements may lead to misunderstandings both during implementation and testing

Equivalence Partitioning (EP) is a black-box test design technique that divides input data into valid and invalid partitions, where each partition is expected to exhibit similar behavior. In the context of acceptance testing, EP is especially effective because it helps validate whether a system behaves correctly for representative input ranges defined in the acceptance criteria.

Acceptance testing aims to confirm that the system meets business requirements and handles inputs as expected. EP allows the tester to cover a large input space using fewer test cases while maintaining a high level of effectiveness. It supports efficiency, broad coverage, and relevance to user expectations.

Other options are less suitable:

A. Static code analysis is a white-box technique, more relevant to unit or integration testing.

B. Input validation is an objective or activity, not a test design technique.

D. Defect-based testing is more diagnostic, used after failures or during exploratory testing — less structured for planned acceptance testing.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.4):

“Black-box techniques such as equivalence partitioning and boundary value analysis are suitable for deriving acceptance tests from user stories or business rules.”

Bi-directional traceability is a fundamental concept in requirements engineering and test management. It refers to the ability to trace:

Forward: From requirements/user stories to corresponding test cases (to ensure all requirements are covered).

Backward: From test cases to the requirements they validate (to ensure every test aligns with a requirement).

According to the ISTQB Certified Tester Foundation Level and Acceptance Testing syllabi, bi-directional traceability is essential to manage test coverage and ensure completeness. It allows project managers and product owners to assess whether all specified requirements/user stories have been covered by appropriate test cases, helping to identify any untested functionality.

This also supports impact analysis during change management — knowing which test cases will be affected by a change in a requirement.

Option B is correct because it precisely captures this benefit. While Option C refers to reviewing test cases against acceptance criteria (a valid review activity), the bi-directional traceability's key benefit from a management and quality assurance perspective is traceability for coverage.

Performance testing evaluates how a system behaves under specific conditions, including load, stress, and endurance. Stress testing, in particular, involves pushing the system beyond its normal operational limits to identify breaking points.

Option B is correct because it describes a classic stress testing scenario: simulating users executing memory-intensive operations to evaluate system resilience and resource management.

Other options:

A describes usage profiles but is more aligned with load testing or configuration testing.

C refers to functional coverage, not performance-specific concerns.

D describes fuzz testing, which is used more for security or robustness testing than performance evaluation.

Answer: B. The system is stressed by simulating various users that perform memory-intensive tasks

Acceptance Test-Driven Development (ATDD) is a collaborative approach in which acceptance criteria are defined early, often before implementation starts. Business process models (e.g., BPMN) and business rule models (e.g., DMN) are essential tools to formalize how the system should behave under various conditions.

In ATDD, these models provide a structured representation of system workflows and decision logic, which can then be used by testers and stakeholders to derive or generate acceptance tests. This ensures that testing is aligned with actual business processes and requirements.

Option C is correct because it aligns with the purpose of ATDD: to use business models as a foundation for deriving acceptance tests in collaboration with business analysts, testers, and developers.

Other options:

A is incorrect — models are created as part of the project, not necessarily before it starts.

B is incorrect — models support and clarify acceptance criteria; they do not replace them.

D is incorrect — models are maintained as living documentation, especially in agile and iterative approaches.

Answer: C. In an ATDD approach, testers use business process and business rule models to generate acceptance tests.

In BPMN models, additional annotations such as links to requirements, test data, or risks improve the value of the diagram for downstream stakeholders like testers. When BPMN tasks or flows are linked to known risks, testers can prioritize regression test cases accordingly — a key principle in risk-based testing.

Option D is correct because linking risks to business processes gives testers meaningful input for deciding which parts of the system require deeper or repeated testing.

Other options:

A: Priority links are useful, but less impactful than risk-based test selection.

B: Links to test equipment are not commonly embedded in process diagrams and are more relevant to hardware or system integration testing.

C: Linking to requirements helps traceability, but execution readiness is more closely tied to test cases and data than to BPMN.

Answer: D. Link to risks provide input to testers for selecting regression tests

Comprehensive Detailed Explanation (Approx. 200–220 words):

This question focuses on the coverage criterion “execute all possible process tasks” from the BPMN model of a $100 withdrawal.

Let’s analyze the process:

The process starts when the user selects “Withdraw $100.”

A decision gateway checks if the balance is ≥ $100.

If NO: the card is removed and withdrawal is rejected.

If YES: the user is prompted to select whether they want a receipt.

Depending on the user’s choice:

If YES: the receipt is printed → then $100 is withdrawn → card is removed.

If NO: $100 is withdrawn → card is removed (no receipt printed).

To meet the criterion “execute all possible process tasks,” we must cover:

Rejected withdrawal path (balance < 100)

Withdrawal without receipt

Withdrawal with receipt

Receipt printing

Card removal in both success and failure

Test case coverage:

Test 1 (balance = $100, receipt = YES): covers successful withdrawal + receipt printed.

Test 3 (balance = $85): covers withdrawal rejected + card removed.

Together, these two tests execute all possible process tasks:

Withdraw with receipt

Reject due to insufficient balance

Receipt printed

Withdraw funds

Remove card

Other test combinations are redundant or do not add new path coverage.

Gherkin is a structured language used in Behavior-Driven Development (BDD) to define test cases in a clear, business-readable format. It follows the GIVEN-WHEN-THEN structure:

GIVEN describes the precondition (system’s state before the action).

WHEN describes the action/event.

THEN describes the expected result or outcome.

Analyzing the phrases:

ii) “The elevator is on the Ground Floor” is a precondition — fits GIVEN.

i) “The total weight of passengers is greater than 200 kg” is an action or state change — fits WHEN.

vi) “A message ‘too many passengers’ is displayed on the screen” is the expected outcome — fits THEN.

Thus, Option A correctly maps these elements to form a well-structured Gherkin scenario.

Other options are incorrect because:

Option B misplaces an expected outcome as an action.

Option C misrepresents the order — “login” isn’t a precondition.

Option D introduces two THEN elements and violates the typical Gherkin structure.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2.2):

“Gherkin test cases use GIVEN-WHEN-THEN structures to make the behavior of the system under test understandable by all stakeholders.”

Collaboration between business analysts and testers is critical in Agile and acceptance testing environments. One of the most effective areas of cooperation is the joint development and review of acceptance criteria for user stories. This ensures that criteria are testable, clearly defined, and aligned with stakeholder expectations.

Option B is correct because creating acceptance criteria is where both business analysts (who understand the business needs) and testers (who ensure testability and clarity) contribute effectively.

Other options:

A (Business needs assessment) is typically a responsibility of business analysts, not a joint activity with testers.

C (Review of risk to prioritize acceptance tests) is a valuable activity but comes after criteria are defined. While it can be collaborative, it's more specific to test planning.

D (Definition of Beta Testing sessions) is less relevant to ongoing collaborative work between testers and BAs — this involves users and release planning.

Answer: B. Development of acceptance criteria for user stories

The relationship between business goals, business needs, and requirements is hierarchical and reflects increasing levels of specificity:

Business Goals: High-level strategic objectives.

Business Needs: Problems or opportunities that must be addressed to achieve those goals.

Requirements: Specific capabilities or conditions the system must satisfy to meet the needs.

Option B is correct because it accurately describes how these elements relate at different abstraction levels in the requirements hierarchy. This relationship is fundamental to business analysis and accepted by standards like BABOK and ISTQB.

Other options:

A is reversed — business goals usually precede and drive the elicitation of requirements.

C and D misrepresent the sequence — product requirements are derived from business goals and needs, not the other way around.

Answer: B. Business goals, business needs and requirements describe, at different levels of abstraction, what shall be achieved

To determine the minimum number of test cases needed to cover:

All unique paths (without repeating loops) in the BPMN process model.

All decision rules (combinations) in the DMN decision table.

Let’s break it down:

BPMN Paths:

If the purchase order is not approved → process ends → 1 path

If approved:

Goods received → “Check of delivery” → Acceptance YES → Payment → 1 path

Goods received → “Check of delivery” → Acceptance NO → Discussion → End → 1 path

= Total distinct BPMN paths: 3

DMN Table:

There are 4 rules based on two inputs (Quality check and Quantity check):

Acceptable + Amount ok → Passed

Substandard + Amount ok → Failed

Acceptable + Amount incorrect → Failed

Substandard + Amount incorrect → Failed

You must execute 4 combinations to cover all decision rules.

To cover both all BPMN flows and all DMN rules, you need a minimum of 4 test cases (each using a different rule from the DMN table and associated BPMN path). Paths may overlap, but all rules must be exercised.

This user story is about a logged-in user measuring their blood sugar using a connected glucose meter and seeing the result quickly. The acceptance criterion specifies that the result should be displayed in less than four seconds.

Option B is correct because:

It starts with a valid GIVEN precondition (“I am logged in”).

The WHEN step matches the functionality described in the user story (blood sugar measurement using a connected device).

The THEN step explicitly includes the performance expectation (“less than 4 seconds”), aligning directly with the acceptance criterion.

Other options:

A is incorrect — while it mentions the correct functionality, “I am diabetic” is not a necessary system precondition.

C refers to blood pressure instead of blood sugar — mismatched with the user story.

D introduces additional functionality (alerts for hypo-/hyperglycemia), which is not part of the specified acceptance criteria.

Answer: B. GIVEN I am logged in on the system … THEN I can see the result … in less than 4 second

Security requirements specify how a system should handle access control, data protection, confidentiality, integrity, and authentication. In acceptance testing, validating that users cannot access data or functions they are not authorized for is a critical test objective when dealing with security.

Option D is correct because it directly relates to access control — a fundamental aspect of security. Ensuring that “normal users shall have restricted access to private data” reflects both a security requirement and a condition that must be tested for compliance.

Other options:

A relates to performance (response time).

B refers to architecture or platform (web-based system).

C is about UI design and usability (style compliance).

Only D addresses security specifically.

Answer: D. Normal users shall have restricted access to private data.

Ensuring traceability between requirements (user stories) and test cases is a cornerstone of quality assurance in acceptance testing. It confirms that all business needs are covered by corresponding tests and helps assess the impact of changes. Traceability matrices or tools are used to track these links throughout the lifecycle.

Option B is correct because regularly verifying and updating traceability ensures that acceptance test coverage remains aligned with evolving requirements — a best practice in quality assurance.

Other options:

A (review of source code) is a white-box technique, more suitable for unit or integration testing.

C (checklist-based verification of requirements) is useful but focuses on requirement quality, not directly on testing activities.

D (eye tracking) is a usability evaluation technique and not standard for verifying test case feasibility.

Answer: B. Verification of the traceability between user stories and test cases to make sure it is up to date.

Beta testing is a form of external user acceptance testing where real users test the product in their environment before the official release. It helps identify issues that may not have been caught in internal testing and gather user feedback on functionality, usability, and performance in real-world conditions.

Option C is correct — the core goal of beta testing is to obtain user feedback in their actual usage context, providing insight into how the system performs outside of controlled environments.

Other options:

A: Test charters are used in exploratory testing, not typically in beta testing.

B: Incorrect — beta testing is not tied to the timing of user story development in Agile.

D: Incorrect — beta testing is performed by end users, not by internal team members like developers or business analysts.

Answer: C. Beta testing aims to obtain feedback from users in their context of use

The medical scanner must be able to examine at least 50 patients per day. This requirement directly impacts hospital operations and service efficiency. If the scanner fails to meet performance requirements, such as processing speed or availability, it will affect the hospital’s ability to deliver services to patients — impacting schedules, patient flow, and ultimately the business goals of the hospital.

Option C is correct because it reflects the consequences of performance shortfalls from a business outcome perspective: failure to meet this requirement may result in financial loss, compliance issues, or customer dissatisfaction.

Other options:

A (User perspective) is involved, but the impact here is primarily operational/business.

B (Functional perspective) refers to whether the scanner has the correct features, not performance.

D (Technical perspective) is also relevant, but the business impact (e.g., service delivery) takes precedence in this case.

Answer: C. Business perspective

The best Gherkin-style acceptance tests are business-oriented, behavior-driven, and avoid unnecessary technical or UI details. They describe actions in a way stakeholders can understand, focusing on system behavior rather than implementation mechanics.

Option A follows Gherkin conventions:

GIVEN clearly describes the system state (account balances).

WHEN describes a user action (transferring funds).

THEN describes a verifiable outcome (account balances updated correctly).

Option B includes unnecessary UI actions like clicking buttons or field names, which are implementation-specific and violate the abstraction level expected of acceptance tests.

Option C uses appropriate structure but introduces incorrect balances in the THEN step (possibly a typo; $4500 on X is wrong if funds were transferred from Y to X).

Option D uses improper syntax — WHEN is misused as another GIVEN, and THEN describes a computation rather than a system behavior.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2.2):

“Acceptance criteria in BDD are best captured through Gherkin scenarios that are understandable by business stakeholders and focus on expected outcomes, not implementation details.”

==================

Effective test reporting should be tailored to the audience’s role and needs. Project managers are typically concerned with high-level progress, schedules, risks, and milestones. Progress trend charts (e.g., test execution over time, defect trends) provide insights into how the project is advancing and help identify delays or bottlenecks.

Option B is correct as it fits the informational needs of a project manager.

Other options:

A: Defect reports are too detailed for steering groups, which prefer strategic summaries or risk reports.

C: Pie charts may provide high-level summaries, but development teams usually need detailed defect or test result data.

D: System users (e.g., customers) are not responsible for project risks and would not benefit from test risk rankings.

Answer: B. Progress trend charts for the project manager