CTFL-AcT ISTQB Certified Tester - Acceptance Testing (CT-AcT) Questions and Answers

In Acceptance Test-Driven Development (ATDD), test cases are derived early and are based on business understanding. Application workflows modeled using BPMN or similar notations provide a clear, visual representation of how a user interacts with a system and which business rules are applied.

Option D is correct because these workflow models help define acceptance test cases by outlining the process paths, user interactions, and decision points. These visual models bridge the gap between business needs and testing.

Other options:

A is incorrect — business rule and process models are created based on need; one doesn ' t necessarily precede the other.

B is misleading — writing business rule models doesn ' t imply stakeholder commitment to ATDD.

C is incorrect — Gherkin is used for writing scenarios in BDD/ATDD, but business rules are typically modeled using DMN, not Gherkin.

Answer: D. Application workflow models facilitate the generation of ATDD acceptance test cases

Comprehensive Detailed Explanation (Approx. 200–220 words):

This question focuses on the coverage criterion “execute all possible process tasks” from the BPMN model of a $100 withdrawal.

Let’s analyze the process:

The process starts when the user selects “Withdraw $100.”

A decision gateway checks if the balance is ≥ $100.

If NO: the card is removed and withdrawal is rejected.

If YES: the user is prompted to select whether they want a receipt.

Depending on the user’s choice:

If YES: the receipt is printed → then $100 is withdrawn → card is removed.

If NO: $100 is withdrawn → card is removed (no receipt printed).

To meet the criterion “execute all possible process tasks,” we must cover:

Rejected withdrawal path (balance < 100)

Withdrawal without receipt

Withdrawal with receipt

Receipt printing

Card removal in both success and failure

Test case coverage:

Test 1 (balance = $100, receipt = YES): covers successful withdrawal + receipt printed.

Test 3 (balance = $85): covers withdrawal rejected + card removed.

Together, these two tests execute all possible process tasks:

Withdraw with receipt

Reject due to insufficient balance

Receipt printed

Withdraw funds

Remove card

Other test combinations are redundant or do not add new path coverage.

Acceptance criteria must be concrete, testable, and focused on observable system behavior. They define what the system must do to satisfy a requirement and help determine whether the requirement has been successfully implemented.

REQ 3.28 states: “The automated system records critical credit application data (CCAD) needed to support application screening.” From this, we infer that the system must persistently store this data after data entry.

Option A is the best match because it provides a specific, observable behavior (CCAD being stored in a MySQL database after a successful entry) that can be verified through acceptance testing. It’s a measurable outcome, aligned with the requirement ' s objective.

Other options are less suitable:

Option B introduces new behavior (displaying a message) not directly tied to the original requirement.

Option C is vague ( " quick and reversible " ) and lacks measurable criteria.

Option D refers to usability guidelines, which is not directly relevant to the storage functionality stated in the requirement.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 1.3.2):

“Well-written acceptance criteria are unambiguous, testable, and focused on observable results.”

The best Gherkin-style acceptance tests are business-oriented, behavior-driven, and avoid unnecessary technical or UI details. They describe actions in a way stakeholders can understand, focusing on system behavior rather than implementation mechanics.

Option A follows Gherkin conventions:

GIVEN clearly describes the system state (account balances).

WHEN describes a user action (transferring funds).

THEN describes a verifiable outcome (account balances updated correctly).

Option B includes unnecessary UI actions like clicking buttons or field names, which are implementation-specific and violate the abstraction level expected of acceptance tests.

Option C uses appropriate structure but introduces incorrect balances in the THEN step (possibly a typo; $4500 on X is wrong if funds were transferred from Y to X).

Option D uses improper syntax — WHEN is misused as another GIVEN, and THEN describes a computation rather than a system behavior.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2.2):

“Acceptance criteria in BDD are best captured through Gherkin scenarios that are understandable by business stakeholders and focus on expected outcomes, not implementation details.”

==================

An exploratory test charter is a high-level plan or mission statement for a time-boxed exploratory testing session. It guides what the tester should focus on during the session and may include the goal of the test, specific areas of the system under test, the risk or feature to explore, the type of persona to simulate (e.g., novice or expert user), and possibly known issues to watch out for.

Option A is correct because specifying a user persona (such as a novice user) helps the tester approach the system from that perspective. This supports the goal of exploratory testing: to simulate realistic usage and uncover issues that scripted tests might miss.

Option B is incorrect — although exploratory testing is adaptive, the charter is defined before the session starts, not elaborated during execution.

Option C is misleading — charters may refer to areas of interest, but not necessarily to a predefined list of activities.

Option D is incorrect — a test oracle (i.e., the mechanism for determining whether a result is correct) is not defined by the charter. It may exist already or be inferred from requirements, heuristics, or user expectations.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 3.1):

“Charters define the focus of exploratory testing sessions and may specify the tester’s role or perspective (e.g., novice user).”

In business process modeling for testing purposes, especially in acceptance testing, it is not always necessary or practical to model the entire system or process in exhaustive detail. ISTQB and the CTFL-BAT (Business Analysis Testing) extension emphasize that test models — including business process models — should serve specific testing objectives.

Focusing the model on what needs to be tested allows the test team to:

Avoid unnecessary complexity,

Highlight relevant paths and decisions,

Derive precise and efficient test cases,

Facilitate stakeholder understanding and validation.

According to the ISTQB Foundation Level Extension – Business Analysis syllabus:

“Process models used in testing should represent the business behavior relevant to the test scope. Including too many irrelevant paths and decisions can lead to inefficient test case design and may distract from the core validation goals.”

Therefore, Option A is correct because limiting the scope of the business process model to the parts that are relevant for testing is a best practice, especially in acceptance testing where focus is on verifying that business needs are met.

Options B, C, and D are not strong justifications:

B suggests avoiding complexity but not purpose-driven modeling.

C incorrectly implies impossibility rather than pragmatic scope.

In cross-functional, globally distributed teams, establishing collaboration, communication, and trust is key. A workshop (even virtual) is a proven method for initiating alignment, especially when a new team member joins, and project coordination is weak.

Option A promotes transparency and collective understanding, crucial for building team cohesion.

Option B is too passive and one-directional. Long emails rarely solve coordination problems in Agile or collaborative contexts.

Option C is about tool setup, not team integration or communication — tools are supportive but not substitutes for human connection.

Option D is not efficient; traveling to meet each team member is impractical and doesn’t guarantee a shared team vision.

✔ Answer: A. You organize a workshop with all team members to establish common understanding and to lay the foundation for fruitful trusting collaboration.

Bi-directional traceability is a fundamental concept in requirements engineering and test management. It refers to the ability to trace:

Forward: From requirements/user stories to corresponding test cases (to ensure all requirements are covered).

Backward: From test cases to the requirements they validate (to ensure every test aligns with a requirement).

According to the ISTQB Certified Tester Foundation Level and Acceptance Testing syllabi, bi-directional traceability is essential to manage test coverage and ensure completeness. It allows project managers and product owners to assess whether all specified requirements/user stories have been covered by appropriate test cases, helping to identify any untested functionality.

This also supports impact analysis during change management — knowing which test cases will be affected by a change in a requirement.

Option B is correct because it precisely captures this benefit. While Option C refers to reviewing test cases against acceptance criteria (a valid review activity), the bi-directional traceability ' s key benefit from a management and quality assurance perspective is traceability for coverage.

The ISTQB CTFL Acceptance Testing Syllabus emphasizes the importance of collaboration between business analysts and testers throughout the testing lifecycle, especially during test planning and risk identification. Business analysts contribute domain knowledge and business context, which is crucial in identifying business-critical areas, defining priorities, and ensuring that acceptance tests align with business goals.

Option A correctly identifies this collaboration. During test planning, business analysts help define acceptance criteria, identify risks from a business perspective, and support test prioritization to focus on high-value features. Their early involvement ensures that acceptance tests are meaningful and support stakeholder expectations.

Option B is incorrect as business analysts actively review acceptance tests to confirm alignment with business rules, regardless of technical complexity.

Option C is inaccurate because although testers seek to understand business needs, the responsibility for identifying those needs lies with business analysts.

Option D is incorrect; business analysts remain engaged throughout the project lifecycle, including test support and defect triage.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 1.4):

“Testers and business analysts collaborate during test planning and analysis activities to ensure the tests meet business needs and risk areas are adequately covered.”

Therefore, A provides the most accurate and comprehensive description.

Acceptance criteria describe what the system must do to fulfill a requirement from the user or business perspective. They must be observable, testable, and relevant to the business outcome or expected behavior.

In this scenario, the user story is about monitoring blood pressure and receiving alerts for excessive pressure. The acceptance criteria should focus on system behavior, thresholds, and how alerts are triggered based on user settings.

Option D is not a good acceptance criterion because:

It specifies a technical implementation detail (JavaScript framework), which is not the concern of acceptance testing.

Acceptance criteria should not prescribe how the system is built, but what it must do from a business or user point of view.

Other options (A, B, and C) all reflect testable and behavior-focused outcomes linked to the user story’s goal.

Answer: D. The system should be developed using JavaScript framework to allow fast response times

Acceptance testing primarily focuses on verifying whether a system meets agreed-upon requirements and satisfies the business and user needs. Quality attributes (also known as non-functional requirements) play a vital role in defining the completeness of the acceptance testing process.

Let’s analyze the options:

ii. Functional suitability — directly relates to whether the system provides the correct functions as per business needs. Essential in acceptance testing.

v. Security — ensures that the system is protected against unauthorized access or data breaches. Often critical for business stakeholders.

vii. Maintainability — reflects how easily the system can be modified. Relevant in acceptance if maintainability requirements are part of contractual criteria.

Thus, Option B (ii, v, vii) contains three attributes that are very relevant for acceptance testing.

Other options:

A includes vi (cognitive ability), which is not a standard ISO 25010 quality attribute.

C includes i (commercializability) — not a system quality attribute defined in ISO 25010.

D includes iii (viability) — more of a business or market consideration, not system testability.

Answer: B. ii, v and vii

Effective test reporting should be tailored to the audience’s role and needs. Project managers are typically concerned with high-level progress, schedules, risks, and milestones. Progress trend charts (e.g., test execution over time, defect trends) provide insights into how the project is advancing and help identify delays or bottlenecks.

Option B is correct as it fits the informational needs of a project manager.

Other options:

A: Defect reports are too detailed for steering groups, which prefer strategic summaries or risk reports.

C: Pie charts may provide high-level summaries, but development teams usually need detailed defect or test result data.

D: System users (e.g., customers) are not responsible for project risks and would not benefit from test risk rankings.

Answer: B. Progress trend charts for the project manager

Acceptance Test-Driven Development (ATDD) is a collaborative approach in which acceptance criteria are defined early, often before implementation starts. Business process models (e.g., BPMN) and business rule models (e.g., DMN) are essential tools to formalize how the system should behave under various conditions.

In ATDD, these models provide a structured representation of system workflows and decision logic, which can then be used by testers and stakeholders to derive or generate acceptance tests. This ensures that testing is aligned with actual business processes and requirements.

Option C is correct because it aligns with the purpose of ATDD: to use business models as a foundation for deriving acceptance tests in collaboration with business analysts, testers, and developers.

Other options:

A is incorrect — models are created as part of the project, not necessarily before it starts.

B is incorrect — models support and clarify acceptance criteria; they do not replace them.

D is incorrect — models are maintained as living documentation, especially in agile and iterative approaches.

Answer: C. In an ATDD approach, testers use business process and business rule models to generate acceptance tests.

Performance testing evaluates how a system behaves under specific conditions, including load, stress, and endurance. Stress testing, in particular, involves pushing the system beyond its normal operational limits to identify breaking points.

Option B is correct because it describes a classic stress testing scenario: simulating users executing memory-intensive operations to evaluate system resilience and resource management.

Other options:

A describes usage profiles but is more aligned with load testing or configuration testing.

C refers to functional coverage, not performance-specific concerns.

D describes fuzz testing, which is used more for security or robustness testing than performance evaluation.

Answer: B. The system is stressed by simulating various users that perform memory-intensive tasks

In Gherkin syntax (Given-When-Then), the purpose is to describe system behavior in a way that’s understandable to all stakeholders. Test steps should focus on user intentions and observable results — not UI implementation details — to ensure maintainability and abstraction.

Line 3 ( " click ' Buy Tickets ' button " ) refers explicitly to a UI element, which should generally be avoided in acceptance tests. Instead, it could say " I request to buy tickets. "

Line 7 ( " I should provide my personal data " ) is describing an action the user must take, not an outcome or result. In a Gherkin “Then” step, we expect an observable system response, not further user interaction.

Option C identifies both of these review concerns correctly.

Other options:

A includes an incorrect comment about line 4 ( " quantity should not be set " ) — setting a value is acceptable.

B is false — the test case has reviewable issues.

D might be valid in a different context (e.g., boundary tests), but that’s not a flaw in the existing scenario.

Answer: C. Line 3 refers to an element of the user interface, which is to be avoided and line 7 is an action and not a result

Security testing ensures the system protects data and maintains intended behavior under potential attacks. Different techniques address specific security goals.

Option A is correct: Static vulnerability analysis inspects code or architecture without executing it, identifying weaknesses in mechanisms such as authentication (e.g., login controls) and authorization (e.g., access permissions). These mechanisms are foundational security requirements.

Other options:

B is misleading — penetration testing simulates attacks, but input validation is more often verified with fuzzing or code review.

C is incorrect — fuzzing tests input handling, not the performance of cryptographic algorithms.

D is incorrect — threat modeling is a design-time activity to identify risks; it’s not used to test policies directly.

Answer: A. Static vulnerability analysis to test authentication and authorization mechanisms

Exploratory testing in Agile projects is a structured but unscripted testing approach where learning, test design, and execution occur simultaneously. Timeboxing is a key practice in managing exploratory testing sessions effectively.

A timebox is a fixed duration (e.g., 60–90 minutes) within which testers explore specific functionalities or risks. It encourages focus, documentation of findings, and prevents overrun or testing fatigue. After the session, testers often hold debriefs to review findings and determine next steps.

Option D is correct because timeboxing is essential for exploratory testing management.

Incorrect options:

A. Pair programming relates to development, not testing.

B. Refactoring is a development technique focused on improving code without changing behavior.

C. Planning poker is used in Agile for effort estimation, not directly related to exploratory testing.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 3.1):

“Exploratory testing is often conducted in time-boxed sessions, with a charter guiding the scope of the session.”

According to ISTQB and the Business Analysis Body of Knowledge (BABOK) standards, the terms business goals , business needs , and requirements are related but represent different levels of abstraction in defining what an organization aims to achieve.

Business Goals represent the high-level strategic objectives an organization wants to accomplish. These are broad statements of intent and typically reflect long-term ambitions.

Business Needs specify what the business must address to meet its goals; these are more focused descriptions of the problems or opportunities that justify the business change. They provide a rationale for why a project or initiative is undertaken.

Requirements are detailed specifications that describe the features, functions, or qualities the solution must have to fulfill the business needs.

The relationship is hierarchical and increasingly specific: business goals set the overarching purpose, business needs interpret these goals into actionable problem statements or opportunities, and requirements specify the solution details.

ISTQB glossary and syllabus excerpts confirm this layered approach, clarifying that these terms are not synonymous but instead describe the same concept at varying levels of detail and abstraction. Therefore, option B best captures this nuanced relationship.

Exact Extract from ISTQB Foundation Level Syllabus (Business Analysis Section):

" Business goals, business needs, and requirements describe, at different levels of abstraction, what shall be achieved by the business change. Business goals are high-level statements; business needs are statements of problems or opportunities to be addressed, and requirements define the detailed attributes of the solution to meet those needs. "

Acceptance Test-Driven Development (ATDD) involves early collaboration between stakeholders to define acceptance criteria and tests before development begins. Using business process models in ATDD helps visualize user behavior, align test cases with real workflows, and serve as living documentation.

Option C is the least meaningful argument because:

Business process models abstractly describe workflows and decisions at a business level. While they help clarify requirements and detect requirement-related defects, they do not directly support detecting defects in the application code, which is typically the focus of unit and integration testing, not acceptance testing.

Let’s validate the other options:

A is a strong argument — process models clarify use cases for testers.

B is valid — graphical models help visualize test coverage directly.

D is true — as business process models evolve, they remain valuable artifacts aligned with current system behavior and requirements.

Answer: C. Business process models will make it easier to detect defects in the application code.

Beta testing is a form of external user acceptance testing where real users test the product in their environment before the official release. It helps identify issues that may not have been caught in internal testing and gather user feedback on functionality, usability, and performance in real-world conditions.

Option C is correct — the core goal of beta testing is to obtain user feedback in their actual usage context, providing insight into how the system performs outside of controlled environments.

Other options:

A: Test charters are used in exploratory testing, not typically in beta testing.

B: Incorrect — beta testing is not tied to the timing of user story development in Agile.

D: Incorrect — beta testing is performed by end users, not by internal team members like developers or business analysts.

Answer: C. Beta testing aims to obtain feedback from users in their context of use

When stakeholders provide conflicting acceptance criteria, resolving the conflict effectively requires focusing on the underlying business goals rather than getting stuck in technical or solution-level disagreements.

Option D is correct because it aligns with the core role of a business analyst and an acceptance tester: to understand and validate business needs. By exploring the root business objectives, you can help stakeholders reframe the problem and reach a compromise based on what delivers the most value.

Other options:

A may lead to confrontation and unproductive discussion without proper facilitation.

B is risky — prioritizing stakeholders may escalate conflict or appear biased.

C assumes you can objectively resolve the conflict based only on pros and cons, but without understanding the business context, the decision may not meet stakeholder needs.

Answer: D. Instead of discussing conflicting technical solutions, you try to understand the underlying business needs