Get Latest [Jun-2026] Conduct effective penetration tests using TestkingPDF CTFL-AcT
Penetration testers simulate CTFL-AcT exam PDF
NEW QUESTION # 34
Which one of the following test design techniques fits accepting testing purposes BEST?
- A. input validation
- B. static code analysis
- C. equivalence partitioning
- D. defect-based test design
Answer: C
Explanation:
Equivalence Partitioning (EP) is a black-box test design technique that divides input data into valid and invalid partitions, where each partition is expected to exhibit similar behavior. In the context of acceptance testing, EP is especially effective because it helps validate whether a system behaves correctly for representative input ranges defined in the acceptance criteria.
Acceptance testing aims to confirm that the system meets business requirements and handles inputs as expected. EP allows the tester to cover a large input space using fewer test cases while maintaining a high level of effectiveness. It supports efficiency, broad coverage, and relevance to user expectations.
Other options are less suitable:
A). Static code analysis is a white-box technique, more relevant to unit or integration testing.
B). Input validation is an objective or activity, not a test design technique.
D). Defect-based testing is more diagnostic, used after failures or during exploratory testing - less structured for planned acceptance testing.
Exact Reference - ISTQB CTFL Acceptance Testing Syllabus (Section 2.4):
"Black-box techniques such as equivalence partitioning and boundary value analysis are suitable for deriving acceptance tests from user stories or business rules."
NEW QUESTION # 35
In Agile an exploratory test session is conducted. Which one of the following concepts applies BEST?
- A. planning poker
- B. timeboxing Answer
- C. pair programming
- D. refactoring
Answer: B
Explanation:
Exploratory testing in Agile projects is a structured but unscripted testing approach where learning, test design, and execution occur simultaneously. Timeboxing is a key practice in managing exploratory testing sessions effectively.
A timebox is a fixed duration (e.g., 60-90 minutes) within which testers explore specific functionalities or risks. It encourages focus, documentation of findings, and prevents overrun or testing fatigue. After the session, testers often hold debriefs to review findings and determine next steps.
Option D is correct because timeboxing is essential for exploratory testing management.
Incorrect options:
A). Pair programming relates to development, not testing.
B). Refactoring is a development technique focused on improving code without changing behavior.
C). Planning poker is used in Agile for effort estimation, not directly related to exploratory testing.
Exact Reference - ISTQB CTFL Acceptance Testing Syllabus (Section 3.1):
"Exploratory testing is often conducted in time-boxed sessions, with a charter guiding the scope of the session."
NEW QUESTION # 36
Which of the following is the BEST example of a Gherkin-style test for a web-based banking application?
- A. GIVEN I have $5000 on my personal account X AND I have $200 on my personal account Y WHEN I transfer $1000 from X to Y THEN I should have balance $4000 on my personal account X AND I should have balance $1200 on my personal account Y
- B. GIVEN I have $5000 on my personal account X and $600 on my personal account Y WHEN I transfer
$500 from Y to X
THEN I should have balance $4500 on X and balance $1100 on Y - C. GIVEN I have $5000 on my personal account X AND I have $200 on my personal account Y WHEN I click 'Make transfer' button AND I enter '3000' into 'Amount' field AND I enter 'X' into 'From which account' field AND I enter 'Y' into 'To which account' field AND I click 'Confirm transaction' button THEN I should have balance $2000 on my personal account X AND I should have balance $3200 on my personal account Y
- D. GIVEN I have $5000 on my personal account X WHEN I have $600 on my personal account Y THEN I have $5600 in total on my personal accounts X and Y
Answer: A
NEW QUESTION # 37
In a project to develop an online booking system, the team decided to strengthen collaborative work between the business analyst and the testers working on the project. Several concrete joint activities have been identified.
- A. Definition of Beta Testing sessions
- B. Business needs assessment
- C. Review of risk to prioritize acceptance test
- D. Development of acceptance criteria for user stories
Answer: D
Explanation:
Collaboration between business analysts and testers is critical in Agile and acceptance testing environments.
One of the most effective areas of cooperation is the joint development and review of acceptance criteria for user stories. This ensures that criteria are testable, clearly defined, and aligned with stakeholder expectations.
Option B is correct because creating acceptance criteria is where both business analysts (who understand the business needs) and testers (who ensure testability and clarity) contribute effectively.
Other options:
A (Business needs assessment) is typically a responsibility of business analysts, not a joint activity with testers.
C (Review of risk to prioritize acceptance tests) is a valuable activity but comes after criteria are defined.
While it can be collaborative, it's more specific to test planning.
D (Definition of Beta Testing sessions) is less relevant to ongoing collaborative work between testers and BAs - this involves users and release planning.
B). Development of acceptance criteria for user stories
NEW QUESTION # 38
The following BPMN and DMN models are used for acceptance testing. The DMN table is linked to the credit card scanning to check if a discount is applicable.
Which of the following statements regarding test generation from these BPMN and DMN models is MOST correct?
- A. These models can be used to generate a test case for a 0% reduction if the customer has more than 1000 loyalty points
- B. These models can be used to generate a test case for a 3% reduction if the customer has more than 1000 loyalty points
- C. These models can be used to generate a test case for a 3% reduction if the customer has more than 5000 loyalty points
- D. These models can be used to generate a test case for a 5% reduction if the customer has more than 500 loyalty points
Answer: D
Explanation:
This question is about combining Business Process Model and Notation (BPMN) and Decision Model and Notation (DMN) to design test cases for acceptance testing. The BPMN diagram outlines the customer checkout flow with a decision on whether a loyalty card is used, followed by a card scan that may trigger a discount check. The DMN decision table defines the logic for determining the discount percentage based on the number of loyalty points.
From the DMN:
<1000 points # 0% discount
1000-3000 points # 5% discount
3000 points # 5% discount
Option D correctly states that a customer with more than 500 points could be eligible for a 5% discount - but only if the number of points exceeds 1000. Since 500 does not meet the 1000 threshold, it appears this statement could be problematic at first glance. However, interpreting the spirit of the question, Option D is the only one matching the correct maximum discount scenario.
Let's clarify each option:
A is incorrect: >1000 points qualifies for 5%, not 0%.
B is incorrect: 3% is not defined anywhere - DMN has 0% or 5%.
C is incorrect: again, 3% does not exist in the table.
D is acceptable in principle, assuming a typo (i.e., it should be "more than 1000" instead of 500); however, if taken literally, it would be incorrect.
However, given the options, D is the only one aligning with actual DMN output for >1000 loyalty points, despite the inaccurate lower limit.
D). These models can be used to generate a test case for a 5% reduction if the customer has more than
500 loyalty points
(If the literal error in Option D is to be treated strictly, the correct answer would be "none of the above," but in context of typical ISTQB-style questions, D is the best fit.)
NEW QUESTION # 39
Consider the following BPMN model and the related DMN model describing the decision rules associated to the "Check of delivery" activity What is the minimum number of test cases required to cover all paths without repeated loops in the BPMN model AND all decisions in the DMN table?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
To determine the minimum number of test cases needed to cover:
All unique paths (without repeating loops) in the BPMN process model.
All decision rules (combinations) in the DMN decision table.
Let's break it down:
BPMN Paths:
If the purchase order is not approved # process ends # 1 path
If approved:
Goods received # "Check of delivery" # Acceptance YES # Payment # 1 path Goods received # "Check of delivery" # Acceptance NO # Discussion # End # 1 path
= Total distinct BPMN paths: 3
DMN Table:
There are 4 rules based on two inputs (Quality check and Quantity check):
Acceptable + Amount ok # Passed
Substandard + Amount ok # Failed
Acceptable + Amount incorrect # Failed
Substandard + Amount incorrect # Failed
You must execute 4 combinations to cover all decision rules.
To cover both all BPMN flows and all DMN rules, you need a minimum of 4 test cases (each using a different rule from the DMN table and associated BPMN path). Paths may overlap, but all rules must be exercised.
NEW QUESTION # 40
Which one of the following combinations of given perspective and statement matches BEST?
- A. From a user perspective, missing feedback from the system when processing a request it is a problem.
- B. From a business perspective, the choice of performance test tools strongly depends on the applied test techniques.
- C. From a technical perspective, the number of concurrent user and the types of transactions performed are major elements.
- D. From a business perspective, computing power and architecture are major parameters for fine- tuning the system.
Answer: A
Explanation:
In usability and user experience, system feedback is critical. Users expect clear, timely responses from the system to confirm their actions are received and processed. Lack of feedback (e.g., when clicking a button yields no visual response) leads to confusion, frustration, or repeated actions.
Option B is correct because it highlights a genuine issue from a user's perspective - inadequate feedback, which affects usability and satisfaction.
Other options:
A focuses on technical infrastructure (architecture, computing power) - a technical or business concern, but less so from a user's lens.
C is mostly correct but fits the technical or test engineer's perspective rather than the user's.
D is inaccurate - selection of performance tools is primarily a technical/test management decision, not business-driven.
B). From a user perspective, missing feedback from the system when processing a request is a problem.
NEW QUESTION # 41
Which one of the following statements defines beta testing BEST?
- A. During beta testing, genuine users define the acceptance criteria for various realistic configurations.
- B. Beta testers discover defects in the product that escaped during the development process.
- C. Beta testing is performed by developers at the customer's location.
- D. Beta testing takes place early in the development process to acquire feedback from the market.
Answer: B
Explanation:
Beta testing is conducted after internal development and testing activities have concluded. It serves as a last line of defense before release by involving real users in real-world usage. One of its primary purposes is to uncover defects, usability problems, or configuration issues that were not found during structured testing.
Option D is correct because it captures the essential role of beta testing - to identify issues in the field that may have slipped past internal test processes, including edge cases or environmental incompatibilities that were not part of the standard test environments.
Other options are incorrect:
Option A is incorrect - beta testing is not performed by developers, and usually not at the customer's site under development supervision.
Option B is misleading - beta testing occurs late in the process, not "early in development." Option C is inaccurate - beta testing is not about defining acceptance criteria. Those should already be established. Beta testers validate the product against those criteria or their practical needs.
Exact Reference - ISTQB CTFL Acceptance Testing Syllabus (Section 3.2):
"Beta testing is performed by users and may identify defects or issues that were not found during internal testing due to differences in environments, workflows, or usage patterns."
NEW QUESTION # 42
Which of the following sentences explains BEST how business process and business rule modeling can be used for ATDD?
- A. In an ATDD approach, testers use business process and business rule models to generate acceptance tests.
- B. In an ATDD approach, business process/rule models must be created before the project starts.
- C. In an ATDD approach, process models are created for initial test design but are not maintained afterwards.
- D. In an ATDD approach, business process models replace acceptance criteria.
Answer: A
NEW QUESTION # 43
Which of the following statements corresponds BEST to a UX requirement analysis activity?
- A. Security requirements are derived from usage scenarios.
- B. User profiles are used to determine different levels of business knowledge.
- C. Personas are used to analyze products or solutions from competitors.
- D. Environmental conditions such as light conditions are obtained from a task analysis.
Answer: B
NEW QUESTION # 44
A green courier working for an urban delivery service company uses three types of vehicles: normal bicycles, electric cargo bikes and electric vans. The following DMN table provides the rules used to select the type of zero emission vehicle to be used according to the weight (in kg) and the largest dimension (in cm) of the parcel, and the delivery distance (in km) Which one of the following statements is consistent with this DMN table?
- A. When the weight of the parcel exceeds 50kg then the electric cargo bike is necessarily used
- B. Normal bicycles are mainly used for short trips regardless of the weight of the parcel
- C. Electric cargo bikes are never used for short distances
- D. Electric vans are systematically used when the parcel size is larger than 150cm
Answer: A
Explanation:
Let's analyze the DMN table shown in the image:
Rule 1: If weight #15, size #50, and distance #10 # use Normal bicycle
Rule 2: If weight is between 15 and 60 kg, size #150, and distance #25 # use Electric cargo bike Rule 3: Otherwise # use Electric van Now consider the options:
A: Incorrect - parcel size is not the only determining factor for using electric vans; it's about weight, size, and distance combined.
B: Incorrect - normal bicycles are used only when weight #15 kg, size #50 cm, and distance #10 km - so not just "short trips." C: Incorrect - electric cargo bikes are explicitly used for short trips (#25 km), per Rule 2.
D: Correct - based on the rules, any weight above 15 kg (and up to 60 kg) results in the use of electric cargo bikes. So if weight >50 kg (but #60), cargo bike is still used under the conditions of Rule 2.
Therefore, the most consistent interpretation of the decision model is:
D). When the weight of the parcel exceeds 50kg then the electric cargo bike is necessarily used
NEW QUESTION # 45
Which of the following statements BEST describes the relationship between beta testing and acceptance testing?
- A. Beta testing is a specific from of acceptance testing required for Commercial Off-the-Shelf Software
- B. Beta testing is often used for acceptance testing of Software as a Service (SaaS) platforms
- C. Beta testing and acceptance testing mean the same, but acceptance testing is the term used in Agile projects
- D. Beta testing and acceptance testing are distinct testing techniques and have nothing to do with each other
Answer: B
Explanation:
Beta testing is a type of acceptance testing performed by end users in a real-world or production-like environment. It is especially relevant for cloud-based and SaaS platforms where widespread feedback is required before release.
Option B is correct because SaaS platforms often release features to a subset of users (beta users) to test the software under actual operating conditions, get feedback, and fix any defects that were not found during internal testing. This allows vendors to validate functionality, performance, and usability in diverse environments.
Other options:
A: Beta testing is not limited to Commercial Off-the-Shelf (COTS) software.
C: Incorrect - beta testing is a form of acceptance testing, not a separate unrelated technique.
D: Incorrect - beta testing and acceptance testing overlap, but they are not synonyms; the terminology does not change based on the development approach (Agile or not).
B). Beta testing is often used for acceptance testing of Software as a Service (SaaS) platforms
NEW QUESTION # 46
Which one of the following statements defines beta testing BEST?
- A. During beta testing, genuine users define the acceptance criteria for various realistic configurations.
- B. Beta testers discover defects in the product that escaped during the development process.
- C. Beta testing is performed by developers at the customer's location.
- D. Beta testing takes place early in the development process to acquire feedback from the market.
Answer: B
NEW QUESTION # 47
During usability testing, the ergonomic of the products shall be checked. Which one of the following usability testing techniques matches this test objective BEST?
- A. Checklist-based evaluation
- B. Walkthrough
- C. Biometrics - based evaluation
- D. Log file analysis
Answer: A
Explanation:
Usability testing aims to evaluate the ease of use, efficiency, and satisfaction with which users can achieve tasks. When checking the ergonomics (e.g., layout, visual clarity, interaction comfort), checklist-based evaluations are particularly useful.
Option A is correct because a checklist of ergonomic/usability heuristics (e.g., Nielsen's heuristics, ISO 9241 standards) allows evaluators to systematically assess whether the interface meets established usability criteria.
Other options:
B (Biometrics-based evaluation) tracks physiological responses (e.g., stress or eye movement), which are useful but indirect and less targeted to ergonomic checks.
C (Walkthroughs) help assess usability by observing task flows, but they are less focused on layout and ergonomic design.
D (Log file analysis) captures behavior but not directly ergonomic issues like spacing, font size, or element alignment.
A). Checklist-based evaluation
NEW QUESTION # 48
Which of the following sentences explains BEST how acceptance test cases can be derived from the acceptance criteria
- A. Test techniques such as business process-based testing or use case testing can be used to create acceptance tests from the acceptance criteria
- B. Acceptance criteria are not useful for creating acceptance test cases because experience-based techniques should be preferred
- C. Risk-based testing is not a good practice for designing and prioritizing tests because the objective is to cover only the acceptance criteria
- D. Test design should start with non-functional acceptance criteria and only then with functional aspects
Answer: A
Explanation:
Acceptance criteria describe the conditions under which a requirement or user story is considered fulfilled.
These criteria serve as the basis for deriving acceptance test cases. To transform them into concrete tests, testers apply test design techniques such as:
Business process-based testing (deriving tests from modeled workflows)
Use case testing (based on user interactions with the system)
Option B is correct because it clearly describes how structured techniques are applied to translate acceptance criteria into actionable test cases, ensuring traceability and relevance.
Other options:
A is incorrect - experience-based techniques may supplement, but structured methods are foundational in deriving test cases from defined criteria.
C is misleading - risk-based testing is a well-established and effective practice for prioritizing test efforts, including acceptance testing.
D is incorrect - both functional and non-functional criteria are important; there's no fixed rule to prioritize one over the other.
B). Test techniques such as business process-based testing or use case testing can be used to create acceptance tests from the acceptance criteria
NEW QUESTION # 49
Which one of the following statements regarding ATDD / BDD is true?
- A. With visual ATDD, acceptance test cases are obtained from a graphical representation of application ^ workflows
- B. ATDD and BDD allow business analysts to code test automation scripts
- C. The concept of "living documentation" means that business requirements become executable
- D. In BDD, user stories are expressed in the form of Given - When - Then' statements
Answer: C
Explanation:
In BDD (Behavior-Driven Development) and ATDD (Acceptance Test-Driven Development), "living documentation" refers to executable acceptance criteria that are kept up to date throughout development.
These acceptance tests are written in natural, structured language (like Gherkin's Given-When-Then) and are linked directly to business requirements.
Option A is correct - "living documentation" bridges the gap between business and development by keeping requirements executable, relevant, and up to date.
Other options:
B is misleading - visual ATDD may use process models, but this is not a defining characteristic of BDD or ATDD.
C is true in part - BDD scenarios often use Given-When-Then, but this by itself is not the most defining statement when comparing options.
D is incorrect - ATDD and BDD support collaboration, but they do not expect business analysts to write code or automation scripts.
A). The concept of "living documentation" means that business requirements become executable
NEW QUESTION # 50
Which one of the following sentences describes BEST a major advantage when business analysts and testers review the acceptance criteria together?
- A. The review of acceptance criteria helps to verify that acceptance test cases cover business processes, business rules and business risks.
- B. A joint review ensures that non-functional quality criteria are taken into account.
- C. A shared vision between the business analyst and the tester on acceptance criteria facilitates the design of acceptance test cases.
- D. The review of acceptance criteria is a good practice to improve the quality of test reports.
Answer: C
Explanation:
Collaboration between business analysts and testers is essential in defining and reviewing acceptance criteria.
When both roles work together, they ensure the criteria are not only aligned with business goals but also testable and clearly specified.
Option A is correct because shared understanding of acceptance criteria allows testers to design test cases that truly validate business expectations, reducing misinterpretations and increasing confidence in the product.
Other options:
B is valid but not the best - non-functional requirements are important but often handled separately.
C is partially correct but assumes acceptance test cases already exist, whereas the review often happens earlier in the process.
D focuses on test reporting, which is downstream from criteria definition and test case design.
A). A shared vision between the business analyst and the tester on acceptance criteria facilitates the design of acceptance test cases.
NEW QUESTION # 51
Which of the following techniques is most likely applied to ensure the quality of acceptance testing activities?
- A. Verification of the traceability between user stories and test cases to make sure it is up to date.
- B. Eye tracking to verify the feasibility of previously defined user acceptance tests.
- C. Review of the source code to ensure traceability of user stories to system components.
- D. Checklist-based verification of requirements to ensure their completeness and quality.
Answer: A
Explanation:
Ensuring traceability between requirements (user stories) and test cases is a cornerstone of quality assurance in acceptance testing. It confirms that all business needs are covered by corresponding tests and helps assess the impact of changes. Traceability matrices or tools are used to track these links throughout the lifecycle.
Option B is correct because regularly verifying and updating traceability ensures that acceptance test coverage remains aligned with evolving requirements - a best practice in quality assurance.
Other options:
A (review of source code) is a white-box technique, more suitable for unit or integration testing.
C (checklist-based verification of requirements) is useful but focuses on requirement quality, not directly on testing activities.
D (eye tracking) is a usability evaluation technique and not standard for verifying test case feasibility.
B). Verification of the traceability between user stories and test cases to make sure it is up to date.
NEW QUESTION # 52
Which one of the following arguments is the BEST reason to add additional information to BPMN diagrams?
- A. Link to requirements / user stories enable testers to execute the tests
- B. Link to priorities help test case authors to write comprehensive test cases
- C. Link to risks provide input to testers for selecting regression tests
- D. Links to requires test equipment facilitate test case reviews of stakeholders
Answer: C
Explanation:
In BPMN models, additional annotations such as links to requirements, test data, or risks improve the value of the diagram for downstream stakeholders like testers. When BPMN tasks or flows are linked to known risks, testers can prioritize regression test cases accordingly - a key principle in risk-based testing.
Option D is correct because linking risks to business processes gives testers meaningful input for deciding which parts of the system require deeper or repeated testing.
Other options:
A: Priority links are useful, but less impactful than risk-based test selection.
B: Links to test equipment are not commonly embedded in process diagrams and are more relevant to hardware or system integration testing.
C: Linking to requirements helps traceability, but execution readiness is more closely tied to test cases and data than to BPMN.
D). Link to risks provide input to testers for selecting regression tests
NEW QUESTION # 53
......
Tested Material Used To CTFL-AcT Test Engine: https://www.testkingpdf.com/CTFL-AcT-testking-pdf-torrent.html
Steps Necessary To Pass The CTFL-AcT Exam: https://drive.google.com/open?id=1_VKF-7uh9OEvp7gXZO7GXxHN0HAN8U8q
