CTFL-AcT ISTQB Certified Tester - Acceptance Testing (CT-AcT) Questions and Answers

To describe business processes and business rules in a structured, visual, and analyzable way, a process modeling tool is the most appropriate. These tools often support standards like BPMN (Business Process Model and Notation) for process workflows and DMN (Decision Model and Notation) for business rules.

Option D is correct because process modeling tools enable business analysts and stakeholders to capture, analyze, and communicate business operations and decision logic, which are foundational for acceptance test case generation in ATDD.

Other options:

A (Project management tools) manage schedules, resources, and scope, not business rules.

B (Test management tools) handle test cases and execution, not business modeling.

C (Defect tracking tools) track bugs but are not used for describing processes or rules.

Answer: D. Process modelling tool

In cross-functional, globally distributed teams, establishing collaboration, communication, and trust is key. A workshop (even virtual) is a proven method for initiating alignment, especially when a new team member joins, and project coordination is weak.

Option A promotes transparency and collective understanding, crucial for building team cohesion.

Option B is too passive and one-directional. Long emails rarely solve coordination problems in Agile or collaborative contexts.

Option C is about tool setup, not team integration or communication — tools are supportive but not substitutes for human connection.

Option D is not efficient; traveling to meet each team member is impractical and doesn’t guarantee a shared team vision.

✔ Answer: A. You organize a workshop with all team members to establish common understanding and to lay the foundation for fruitful trusting collaboration.

In usability and user experience, system feedback is critical. Users expect clear, timely responses from the system to confirm their actions are received and processed. Lack of feedback (e.g., when clicking a button yields no visual response) leads to confusion, frustration, or repeated actions.

Option B is correct because it highlights a genuine issue from a user’s perspective — inadequate feedback, which affects usability and satisfaction.

Other options:

A focuses on technical infrastructure (architecture, computing power) — a technical or business concern, but less so from a user’s lens.

C is mostly correct but fits the technical or test engineer’s perspective rather than the user’s.

D is inaccurate — selection of performance tools is primarily a technical/test management decision, not business-driven.

Answer: B. From a user perspective, missing feedback from the system when processing a request is a problem.

Exploratory testing is a dynamic testing technique where learning, test design, execution, and interpretation occur simultaneously. It is especially useful when detailed requirements are unavailable or when testers rely on experience and intuition.

A is correct: Exploratory testing combines exploration, learning about the product, designing and executing tests on the fly, and interpreting the results — all within the same session.

E is also correct: Exploratory testing usually starts with a high-level test charter that defines the mission, objectives, or focus area for the session. It may not define specific test conditions, but it outlines the scope and intent.

Other options:

B: Not accurate — while timeboxing is used, exploratory testing typically relies on charters and experience rather than detailed product risk analysis to prioritize.

C: Incorrect — exploratory testing is not about refining acceptance criteria; that’s part of ATDD.

D: Partially true but misleading — good business domain knowledge helps, but understanding the functionality is also important in exploratory testing.

Answer: A and E

Beta testing is conducted after internal development and testing activities have concluded. It serves as a last line of defense before release by involving real users in real-world usage. One of its primary purposes is to uncover defects, usability problems, or configuration issues that were not found during structured testing.

Option D is correct because it captures the essential role of beta testing — to identify issues in the field that may have slipped past internal test processes, including edge cases or environmental incompatibilities that were not part of the standard test environments.

Other options are incorrect:

Option A is incorrect — beta testing is not performed by developers, and usually not at the customer’s site under development supervision.

Option B is misleading — beta testing occurs late in the process, not “early in development.”

Option C is inaccurate — beta testing is not about defining acceptance criteria. Those should already be established. Beta testers validate the product against those criteria or their practical needs.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 3.2):

“Beta testing is performed by users and may identify defects or issues that were not found during internal testing due to differences in environments, workflows, or usage patterns.”

“Early Testing” is a well-known best practice in software testing, promoting the involvement of testers early in the project — ideally during requirements definition — to identify ambiguities, risks, and inconsistencies.

Option B is correct because involving both testers and business analysts in defining acceptance criteria helps ensure those criteria are clear, testable, and aligned with business needs from the outset. This leads to fewer misunderstandings and defects later in the lifecycle.

Other options:

A is incorrect — Agile does not eliminate requirements engineering; it adapts it with user stories, refinement, and just-in-time elaboration.

C is incorrect — test analysis interprets existing requirements; it doesn’t produce them.

D is false — while some level of test independence is valuable, Agile promotes collaboration between roles to achieve shared understanding.

Answer: B. The joint work of business analyst and testers on acceptance criteria and acceptance test cases contributes to the "Early Testing" best practice

Acceptance criteria describe what the system must do to fulfill a requirement from the user or business perspective. They must be observable, testable, and relevant to the business outcome or expected behavior.

In this scenario, the user story is about monitoring blood pressure and receiving alerts for excessive pressure. The acceptance criteria should focus on system behavior, thresholds, and how alerts are triggered based on user settings.

Option D is not a good acceptance criterion because:

It specifies a technical implementation detail (JavaScript framework), which is not the concern of acceptance testing.

Acceptance criteria should not prescribe how the system is built, but what it must do from a business or user point of view.

Other options (A, B, and C) all reflect testable and behavior-focused outcomes linked to the user story’s goal.

Answer: D. The system should be developed using JavaScript framework to allow fast response times

Non-functional quality attributes (also called quality characteristics) such as usability, reliability, operability, performance, and maintainability are often validated during acceptance testing to ensure the system behaves as expected under real-world conditions.

Option C is correct because operability — a subcharacteristic of usability per ISO 25010 — refers to the degree to which users can operate and control the system effectively. Acceptance testing often involves running the system in realistic settings to validate these aspects.

Other options:

A (Modularity and reusability) are more relevant to system architecture and design, not acceptance testing.

B is incorrect — time behavior (performance) can and should be tested at multiple levels, including system and integration testing before acceptance.

D is misleading — testing basic functionality is necessary, but it does not address non-functional quality attributes.

Answer: C. During acceptance testing, the operability of the product is checked in a realistic environment

Beta testing is a type of external user acceptance testing performed by potential or existing customers in a real-world environment. It typically occurs after internal validation and acceptance tests have been passed. The purpose is to validate the product in realistic contexts, identify usability issues, uncover defects that may have been missed in lab settings, and gather feedback for improvements.

Option C is correct because it best describes the intent and value of beta testing — to observe how the product performs in real-life configurations, which may include varying hardware, usage patterns, or business workflows.

Option A is incorrect — while some people use the terms loosely, beta testing is not a strict synonym for acceptance testing. Acceptance testing usually refers to more formal, criteria-driven testing (e.g., alpha or internal acceptance testing), while beta testing emphasizes broad, usage-based validation.

Option B is misleading — beta testers may follow scenarios, but beta testing is not typically based on predefined acceptance criteria alone. It emphasizes exploration in realistic use cases.

Option D is false — beta testing is not primarily about measuring test coverage. It is qualitative and feedback-driven rather than systematically structured.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 3.2):

“Beta testing is performed by users in their own environment and supports validation of the system in realistic operational conditions.”

Security testing ensures the system protects data and maintains intended behavior under potential attacks. Different techniques address specific security goals.

Option A is correct: Static vulnerability analysis inspects code or architecture without executing it, identifying weaknesses in mechanisms such as authentication (e.g., login controls) and authorization (e.g., access permissions). These mechanisms are foundational security requirements.

Other options:

B is misleading — penetration testing simulates attacks, but input validation is more often verified with fuzzing or code review.

C is incorrect — fuzzing tests input handling, not the performance of cryptographic algorithms.

D is incorrect — threat modeling is a design-time activity to identify risks; it’s not used to test policies directly.

Answer: A. Static vulnerability analysis to test authentication and authorization mechanisms

Comprehensive Detailed Explanation (Approx. 200–220 words):

This question focuses on the coverage criterion “execute all possible process tasks” from the BPMN model of a $100 withdrawal.

Let’s analyze the process:

The process starts when the user selects “Withdraw $100.”

A decision gateway checks if the balance is ≥ $100.

If NO: the card is removed and withdrawal is rejected.

If YES: the user is prompted to select whether they want a receipt.

Depending on the user’s choice:

If YES: the receipt is printed → then $100 is withdrawn → card is removed.

If NO: $100 is withdrawn → card is removed (no receipt printed).

To meet the criterion “execute all possible process tasks,” we must cover:

Rejected withdrawal path (balance < 100)

Withdrawal without receipt

Withdrawal with receipt

Receipt printing

Card removal in both success and failure

Test case coverage:

Test 1 (balance = $100, receipt = YES): covers successful withdrawal + receipt printed.

Test 3 (balance = $85): covers withdrawal rejected + card removed.

Together, these two tests execute all possible process tasks:

Withdraw with receipt

Reject due to insufficient balance

Receipt printed

Withdraw funds

Remove card

Other test combinations are redundant or do not add new path coverage.

Acceptance criteria define the conditions under which a user story or requirement is considered complete and acceptable to stakeholders. They clarify the expected behavior, outcomes, or attributes of the system.

Option C is correct because it accurately reflects that acceptance criteria are used to specify what is expected from the system in relation to a given requirement or user story. This ensures a shared understanding among developers, testers, and business stakeholders.

Other options:

A is vague and misleading — acceptance criteria relate directly to specific stories or features, not generally to high-level goals.

B is partially correct but limited — while acceptance criteria help define test conditions, their purpose is broader than just test specification.

D is incorrect — acceptance criteria are not related to code coverage, which is a technical test metric.

Answer: C. For each requirement or user story, the acceptance criteria refine and specify what is expected

In Gherkin syntax (Given-When-Then), the purpose is to describe system behavior in a way that’s understandable to all stakeholders. Test steps should focus on user intentions and observable results — not UI implementation details — to ensure maintainability and abstraction.

Line 3 ("click 'Buy Tickets' button") refers explicitly to a UI element, which should generally be avoided in acceptance tests. Instead, it could say "I request to buy tickets."

Line 7 ("I should provide my personal data") is describing an action the user must take, not an outcome or result. In a Gherkin “Then” step, we expect an observable system response, not further user interaction.

Option C identifies both of these review concerns correctly.

Other options:

A includes an incorrect comment about line 4 ("quantity should not be set") — setting a value is acceptable.

B is false — the test case has reviewable issues.

D might be valid in a different context (e.g., boundary tests), but that’s not a flaw in the existing scenario.

Answer: C. Line 3 refers to an element of the user interface, which is to be avoided and line 7 is an action and not a result

Ensuring traceability between requirements (user stories) and test cases is a cornerstone of quality assurance in acceptance testing. It confirms that all business needs are covered by corresponding tests and helps assess the impact of changes. Traceability matrices or tools are used to track these links throughout the lifecycle.

Option B is correct because regularly verifying and updating traceability ensures that acceptance test coverage remains aligned with evolving requirements — a best practice in quality assurance.

Other options:

A (review of source code) is a white-box technique, more suitable for unit or integration testing.

C (checklist-based verification of requirements) is useful but focuses on requirement quality, not directly on testing activities.

D (eye tracking) is a usability evaluation technique and not standard for verifying test case feasibility.

Answer: B. Verification of the traceability between user stories and test cases to make sure it is up to date.

The relationship between testing and requirements engineering is iterative and collaborative. According to ISTQB CTFL and IQBBA FL syllabi, test activities such as test analysis and test design involve reviewing and interpreting acceptance criteria to derive test conditions and test cases. During this process, testers may identify ambiguities, conflicts, or missing acceptance conditions. These insights often result in feedback to business analysts or stakeholders, leading to refinement or changes in the acceptance criteria to ensure clarity, completeness, and testability.

This iterative feedback loop is essential in both Agile and traditional lifecycles. Therefore, option D is correct. It reflects the dynamic interaction between requirements and test design, where improving one often improves the other.

Other options are incorrect:

Option A falsely assumes business analysts don’t engage in test design, while in practice, they collaborate closely with testers.

Option B incorrectly suggests that IQBBA and ISTQB lifecycles are mutually exclusive. In fact, they complement each other.

Option C is incorrect in sequencing. In reality, solution evaluation (IQBBA) follows test execution, not precedes it.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 1.3.2):

“During test analysis, inconsistencies or missing information in the acceptance criteria can be identified and addressed through collaboration with business analysts.”

==================

According to ISO/IEC 25010:2011, the “Quality in Use” model includes characteristics that measure the system’s impact on stakeholders during actual usage in a specific context.

The four main characteristics of Quality in Use are:

Effectiveness

Efficiency

Satisfaction

Freedom from Risk

Option C is correct because “Satisfaction” is one of the core quality-in-use characteristics and refers to the degree to which user needs are fulfilled in context.

Other options:

A (User experience) is a broader term not formally defined as a Quality in Use characteristic in ISO 25010.

B (Security) is part of the product quality model, not quality in use.

D (Freedom of interference) is not a defined term in ISO 25010; it may be a misstatement of "freedom from risk."

Answer: C. Satisfaction

ISO/IEC 25010 defines two key quality models:

Product Quality Model (e.g., Usability, Security, Portability)

Quality in Use Model — which includes characteristics of the user’s experience when interacting with the product in a real-world context.

The four main characteristics of the Quality in Use model are:

Effectiveness

Efficiency

Satisfaction

Freedom from risk

Option A — Efficiency is one of the key Quality in Use characteristics, as it refers to the resources used to achieve goals with accuracy and completeness.

Other options:

B (Usability), C (Compatibility), and D (Portability) are characteristics of the Product Quality Model, not of Quality in Use.

Therefore, the correct answer, as per ISO 25010:2011, is:

Answer: A. Efficiency

In Acceptance Test-Driven Development (ATDD), test cases are derived early and are based on business understanding. Application workflows modeled using BPMN or similar notations provide a clear, visual representation of how a user interacts with a system and which business rules are applied.

Option D is correct because these workflow models help define acceptance test cases by outlining the process paths, user interactions, and decision points. These visual models bridge the gap between business needs and testing.

Other options:

A is incorrect — business rule and process models are created based on need; one doesn't necessarily precede the other.

B is misleading — writing business rule models doesn't imply stakeholder commitment to ATDD.

C is incorrect — Gherkin is used for writing scenarios in BDD/ATDD, but business rules are typically modeled using DMN, not Gherkin.

Answer: D. Application workflow models facilitate the generation of ATDD acceptance test cases

Performance testing assesses how a system behaves under specific conditions, typically focusing on responsiveness, stability, and resource usage. The type of performance test depends on the workload model:

Load testing evaluates performance under expected peak usage.

Stress testing pushes the system beyond its capacity to assess limits.

Endurance/stability testing checks for performance degradation over extended periods.

Option A correctly describes that performance test types are determined by the workload simulation strategy.

Other options:

B confuses performance with security testing — malicious attack robustness is a security focus, not performance.

C is partly correct but less comprehensive than A. While testing should simulate realistic conditions, categorization into stress/load/endurance is better aligned with workload modeling.

D is misleading — performance tests validate systems against performance requirements; they are not primarily used to define them.

Answer: A. Depending on the model used to simulate the workload, performance tests are called load, stress or endurance / stability tests.

Acceptance criteria describe the conditions under which a requirement or user story is considered fulfilled. These criteria serve as the basis for deriving acceptance test cases. To transform them into concrete tests, testers apply test design techniques such as:

Business process-based testing (deriving tests from modeled workflows)

Use case testing (based on user interactions with the system)

Option B is correct because it clearly describes how structured techniques are applied to translate acceptance criteria into actionable test cases, ensuring traceability and relevance.

Other options:

A is incorrect — experience-based techniques may supplement, but structured methods are foundational in deriving test cases from defined criteria.

C is misleading — risk-based testing is a well-established and effective practice for prioritizing test efforts, including acceptance testing.

D is incorrect — both functional and non-functional criteria are important; there’s no fixed rule to prioritize one over the other.

Answer: B. Test techniques such as business process-based testing or use case testing can be used to create acceptance tests from the acceptance criteria

This user story is about a logged-in user measuring their blood sugar using a connected glucose meter and seeing the result quickly. The acceptance criterion specifies that the result should be displayed in less than four seconds.

Option B is correct because:

It starts with a valid GIVEN precondition (“I am logged in”).

The WHEN step matches the functionality described in the user story (blood sugar measurement using a connected device).

The THEN step explicitly includes the performance expectation (“less than 4 seconds”), aligning directly with the acceptance criterion.

Other options:

A is incorrect — while it mentions the correct functionality, “I am diabetic” is not a necessary system precondition.

C refers to blood pressure instead of blood sugar — mismatched with the user story.

D introduces additional functionality (alerts for hypo-/hyperglycemia), which is not part of the specified acceptance criteria.

Answer: B. GIVEN I am logged in on the system … THEN I can see the result … in less than 4 second