CTFL-AcT Practice Exam Questions with Answers ISTQB Certified Tester - Acceptance Testing (CT-AcT) Certification

Poorly defined requirements are a leading cause of defects and project failure. According to the ISTQB CTFL Acceptance Testing Syllabus and IQBBA FL Syllabus, the quality of requirements plays a critical role in successful solution development and acceptance testing. Requirements must be clear, unambiguous, complete, and testable. When they are vague or ambiguous, stakeholders may interpret them differently, which can lead to incorrect implementations, inadequate testing, and ultimately rework or rejection during acceptance.

Option A is explicitly supported by the ISTQB Foundation Syllabus and IQBBA principles. In contrast:

Option B is incorrect because Agile lifecycles still place great emphasis on requirement engineering, even though requirements evolve iteratively.

Option C misrepresents INVEST: it is a guideline for writing good user stories but does not replace reviews or validation techniques.

Option D is risky and not endorsed by ISTQB. While testers may identify ambiguities, the correct approach is to clarify them with all relevant stakeholders, not make assumptions.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 1.3.1):

“Ambiguous, incomplete, or inconsistent requirements increase the risk of misunderstanding between stakeholders, leading to incorrect implementation and ineffective tests.”

Graphical representations of business processes, particularly using BPMN (Business Process Model and Notation), serve as a bridge between business stakeholders and testers. These models help visualize the steps a user or system goes through, making it easier to derive test cases.

Option C is correct because acceptance testing aims to validate the system’s behavior from the user or business perspective. Therefore, focusing on key user workflows (rather than exhaustive technical or exception paths) aligns with the purpose of acceptance testing: to ensure that the system meets agreed-upon business requirements.

Option A is incorrect because decision tables are part of DMN (Decision Model and Notation), not BPMN.

Option B is too rigid — not all alternative/error paths must be modeled in early acceptance testing unless they are critical to business rules.

Option D misapplies the standards — DMN is used to model business rules, not the complete business process.

Answer: C. For acceptance testing, graphical business process models should focus on the user workflows to be tested.

User Experience (UX) requirement analysis is a critical component of acceptance testing and product development. According to ISTQB Acceptance Testing syllabus and industry-aligned UX design methodologies (e.g., ISO 9241-210 and BABOK guidelines), UX requirement analysis is typically structured around the following pillars:

User Analysis – Understanding who the users are (roles, goals, experience levels)

Task Analysis – Understanding what users do (tasks, workflows, pain points)

Context Analysis – Understanding where and how users interact with the product (environmental and contextual factors)

Competitor Analysis – Understanding how similar problems are solved in the market

Option B best describes Task Analysis, one of the most practical and impactful pillars. In task analysis, business analysts and UX researchers observe how users interact with current or comparable systems to understand workflow patterns, user frustrations, needs, and required system functionality. This method helps uncover implicit needs that users may not articulate in interviews.

This approach is aligned with ISTQB’s emphasis on understanding real-world usage and business processes as a foundation for deriving acceptance criteria and tests. It supports the creation of realistic scenarios that reflect actual user behavior, which is essential for verifying system fitness for use.

The other options are inaccurate:

A refers to psychological disposition, which is more aligned with user profiling or persona development, not a core focus of user analysis in requirement engineering.

C incorrectly ties context analysis with deriving security requirements, which is not its purpose.

D describes an unrealistic or incorrect method for competitor analysis.

Therefore, Option B is the best description of a key pillar of UX requirement analysis per industry and ISTQB standards.

In ISTQB Acceptance Testing context, the process of refining requirements or user stories into acceptance criteria plays a crucial role in defining clear, testable conditions. These acceptance criteria act as the basis for deriving test conditions, which are in turn used to design acceptance test cases.

According to the ISTQB Foundation Level Acceptance Testing syllabus:

“Acceptance criteria are refined expressions of business requirements, and they help to determine the scope and intent of acceptance tests. These criteria are used to derive test conditions and guide the development of test cases.”

This alignment ensures that the delivered software meets the expectations set out in the requirements and satisfies the user needs. Acceptance tests are typically written from the user’s perspective and are focused on verifying that the system behaves correctly in realistic business scenarios.

Option B is correct because it explicitly describes this logical and procedural relationship between user stories, acceptance criteria, and acceptance tests.

Other options are incorrect or misleading:

A is incorrect: reviewing requirements does not eliminate the need for dynamic testing.

C is incorrect: code coverage is more relevant for unit or system-level testing, not acceptance testing.

D is incorrect: exploratory testing is a valuable supplement but does not replace the need to verify acceptance criteria.

Acceptance criteria describe the conditions under which a requirement or user story is considered fulfilled. These criteria serve as the basis for deriving acceptance test cases. To transform them into concrete tests, testers apply test design techniques such as:

Business process-based testing (deriving tests from modeled workflows)

Use case testing (based on user interactions with the system)

Option B is correct because it clearly describes how structured techniques are applied to translate acceptance criteria into actionable test cases, ensuring traceability and relevance.

Other options:

A is incorrect — experience-based techniques may supplement, but structured methods are foundational in deriving test cases from defined criteria.

C is misleading — risk-based testing is a well-established and effective practice for prioritizing test efforts, including acceptance testing.

D is incorrect — both functional and non-functional criteria are important; there’s no fixed rule to prioritize one over the other.

Answer: B. Test techniques such as business process-based testing or use case testing can be used to create acceptance tests from the acceptance criteria

Gherkin is a structured language used in Behavior-Driven Development (BDD) to define test cases in a clear, business-readable format. It follows the GIVEN-WHEN-THEN structure:

GIVEN describes the precondition (system’s state before the action).

WHEN describes the action/event.

THEN describes the expected result or outcome.

Analyzing the phrases:

ii) “The elevator is on the Ground Floor” is a precondition — fits GIVEN.

i) “The total weight of passengers is greater than 200 kg” is an action or state change — fits WHEN.

vi) “A message ‘too many passengers’ is displayed on the screen” is the expected outcome — fits THEN.

Thus, Option A correctly maps these elements to form a well-structured Gherkin scenario.

Other options are incorrect because:

Option B misplaces an expected outcome as an action.

Option C misrepresents the order — “login” isn’t a precondition.

Option D introduces two THEN elements and violates the typical Gherkin structure.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2.2):

“Gherkin test cases use GIVEN-WHEN-THEN structures to make the behavior of the system under test understandable by all stakeholders.”

Equivalence Partitioning (EP) is a black-box test design technique that divides input data into valid and invalid partitions, where each partition is expected to exhibit similar behavior. In the context of acceptance testing, EP is especially effective because it helps validate whether a system behaves correctly for representative input ranges defined in the acceptance criteria.

Acceptance testing aims to confirm that the system meets business requirements and handles inputs as expected. EP allows the tester to cover a large input space using fewer test cases while maintaining a high level of effectiveness. It supports efficiency, broad coverage, and relevance to user expectations.

Other options are less suitable:

A. Static code analysis is a white-box technique, more relevant to unit or integration testing.

B. Input validation is an objective or activity, not a test design technique.

D. Defect-based testing is more diagnostic, used after failures or during exploratory testing — less structured for planned acceptance testing.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.4):

“Black-box techniques such as equivalence partitioning and boundary value analysis are suitable for deriving acceptance tests from user stories or business rules.”

Security testing ensures the system protects data and maintains intended behavior under potential attacks. Different techniques address specific security goals.

Option A is correct: Static vulnerability analysis inspects code or architecture without executing it, identifying weaknesses in mechanisms such as authentication (e.g., login controls) and authorization (e.g., access permissions). These mechanisms are foundational security requirements.

Other options:

B is misleading — penetration testing simulates attacks, but input validation is more often verified with fuzzing or code review.

C is incorrect — fuzzing tests input handling, not the performance of cryptographic algorithms.

D is incorrect — threat modeling is a design-time activity to identify risks; it’s not used to test policies directly.

Answer: A. Static vulnerability analysis to test authentication and authorization mechanisms

ATDD and BDD are agile development approaches that emphasize collaboration among stakeholders (such as business analysts, developers, testers, and customers) to define clear and testable acceptance criteria before or as requirements are being finalized. Both techniques promote using concrete examples to drive development and validate understanding.

In ATDD, acceptance test cases are derived directly from user stories or requirements and written before the actual implementation starts. In BDD, scenarios are expressed in natural language (often using Gherkin syntax) to describe behaviors the system should exhibit under specific conditions. In both cases, these tests serve not only as validation tools but also as executable specifications — i.e., shared understanding expressed through concrete examples.

Option B is correct because both methodologies use examples (scenarios/test cases) to describe how a system should behave — serving as acceptance criteria.

Incorrect options:

Option A wrongly suggests BDD defers testing until after requirements are finalized — it actually promotes early collaboration.

Option C is false — in ATDD, test cases are based on predefined acceptance criteria, not written beforehand.

Option D is inaccurate — acceptance tests in ATDD and BDD may be automated but are collaboratively written first, not by test automation engineers alone.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 2.2):

“Both ATDD and BDD involve the collaborative definition of test cases before implementation to clarify requirements and serve as product usage examples.”

Comprehensive Detailed Explanation (Approx. 200 words):

Acceptance criteria should focus on business-relevant outcomes that are specific, testable, and observable. In this user story, the goal is to validate that the registration functionality is available and behaves as expected.

Let's analyze each proposition:

i) “A registration form is displayed on the screen.”

? Valid. It is observable, specific, and directly aligned with the user story.

ii) “The form is written in the Groovy language; the cursor is initially set on the ‘login’ field...”

? Invalid as acceptance criteria. It contains implementation details (e.g., “Groovy language”) irrelevant to business stakeholders. Also, low-level UI behavior like cursor position is overly technical and not a business-driven criterion.

iii) “I cannot register myself if the login I choose is used by another player.”

? Valid. It defines system behavior based on a business rule (unique login) and is testable.

iv) “After successful registration process I am informed about it by an e-mail.”

? Valid. It describes a user-visible outcome after registration, which is observable and testable.

Correct answer: D. only i), iii), and iv) are well-written acceptance criteria.

Exact Reference – ISTQB CTFL Acceptance Testing Syllabus (Section 1.3.2):

“Acceptance criteria must describe the externally visible and verifiable system behavior, excluding implementation details.”

To describe business processes and business rules in a structured, visual, and analyzable way, a process modeling tool is the most appropriate. These tools often support standards like BPMN (Business Process Model and Notation) for process workflows and DMN (Decision Model and Notation) for business rules.

Option D is correct because process modeling tools enable business analysts and stakeholders to capture, analyze, and communicate business operations and decision logic, which are foundational for acceptance test case generation in ATDD.

Other options:

A (Project management tools) manage schedules, resources, and scope, not business rules.

B (Test management tools) handle test cases and execution, not business modeling.

C (Defect tracking tools) track bugs but are not used for describing processes or rules.

Answer: D. Process modelling tool

The relationship between business goals, business needs, and requirements is hierarchical and reflects increasing levels of specificity:

Business Goals: High-level strategic objectives.

Business Needs: Problems or opportunities that must be addressed to achieve those goals.

Requirements: Specific capabilities or conditions the system must satisfy to meet the needs.

Option B is correct because it accurately describes how these elements relate at different abstraction levels in the requirements hierarchy. This relationship is fundamental to business analysis and accepted by standards like BABOK and ISTQB.

Other options:

A is reversed — business goals usually precede and drive the elicitation of requirements.

C and D misrepresent the sequence — product requirements are derived from business goals and needs, not the other way around.

Answer: B. Business goals, business needs and requirements describe, at different levels of abstraction, what shall be achieved

In usability and user experience, system feedback is critical. Users expect clear, timely responses from the system to confirm their actions are received and processed. Lack of feedback (e.g., when clicking a button yields no visual response) leads to confusion, frustration, or repeated actions.

Option B is correct because it highlights a genuine issue from a user’s perspective — inadequate feedback, which affects usability and satisfaction.

Other options:

A focuses on technical infrastructure (architecture, computing power) — a technical or business concern, but less so from a user’s lens.

C is mostly correct but fits the technical or test engineer’s perspective rather than the user’s.

D is inaccurate — selection of performance tools is primarily a technical/test management decision, not business-driven.

Answer: B. From a user perspective, missing feedback from the system when processing a request is a problem.

Comprehensive Detailed Explanation:

According to the scenario described in the question, the business process for expense reimbursement includes two key timing constraints:

If the request is not processed within 7 days, an "ongoing" email is sent to the employee.

If the request is not completed within 30 days, the process is canceled and the employee is asked to resubmit the request.

However, in the BPMN model presented in the image, the second timing event (clock icon near "Approval in Progress") incorrectly shows 23 days instead of 30 days. This discrepancy misrepresents the actual business rule and violates the accuracy required in process modeling.

ISTQB Foundation Level Extension – Acceptance Testing syllabus and the Certified Tester Foundation Level Business Process Testing (CTFL-BAT) emphasize that a process model should correctly reflect the specified behavior, rules, and constraints of the business scenario. An incorrect timer can lead to miscommunication between stakeholders and incorrect automation or implementation logic.

Therefore, Option A is the most likely review comment since it directly points to this inconsistency in the model.

According to ISTQB and the Business Analysis Body of Knowledge (BABOK) standards, the terms business goals, business needs, and requirements are related but represent different levels of abstraction in defining what an organization aims to achieve.

Business Goals represent the high-level strategic objectives an organization wants to accomplish. These are broad statements of intent and typically reflect long-term ambitions.

Business Needs specify what the business must address to meet its goals; these are more focused descriptions of the problems or opportunities that justify the business change. They provide a rationale for why a project or initiative is undertaken.

Requirements are detailed specifications that describe the features, functions, or qualities the solution must have to fulfill the business needs.

The relationship is hierarchical and increasingly specific: business goals set the overarching purpose, business needs interpret these goals into actionable problem statements or opportunities, and requirements specify the solution details.

ISTQB glossary and syllabus excerpts confirm this layered approach, clarifying that these terms are not synonymous but instead describe the same concept at varying levels of detail and abstraction. Therefore, option B best captures this nuanced relationship.

Exact Extract from ISTQB Foundation Level Syllabus (Business Analysis Section):

"Business goals, business needs, and requirements describe, at different levels of abstraction, what shall be achieved by the business change. Business goals are high-level statements; business needs are statements of problems or opportunities to be addressed, and requirements define the detailed attributes of the solution to meet those needs."

Acceptance criteria define the conditions under which a user story or requirement is considered complete and acceptable to stakeholders. They clarify the expected behavior, outcomes, or attributes of the system.

Option C is correct because it accurately reflects that acceptance criteria are used to specify what is expected from the system in relation to a given requirement or user story. This ensures a shared understanding among developers, testers, and business stakeholders.

Other options:

A is vague and misleading — acceptance criteria relate directly to specific stories or features, not generally to high-level goals.

B is partially correct but limited — while acceptance criteria help define test conditions, their purpose is broader than just test specification.

D is incorrect — acceptance criteria are not related to code coverage, which is a technical test metric.

Answer: C. For each requirement or user story, the acceptance criteria refine and specify what is expected

The goal here is to achieve full decision coverage (also known as branch coverage), which means each decision point in the process must evaluate to both TRUE and FALSE at least once during testing.

From the BPMN ATM withdrawal model, we identify two key decisions:

Is the balance ? $100?

If yes, is receipt = YES?

To achieve full decision coverage:

One test must evaluate decision 1 as TRUE and another as FALSE.

If decision 1 is TRUE, then decision 2 must be exercised both ways (receipt = YES and NO), but for minimal decision coverage, one path through decision 2 is enough.

Analyzing test cases:

Test 1 (balance = $100, receipt = YES): decision 1 = TRUE, decision 2 = TRUE

Test 2 (balance = $99): decision 1 = FALSE

These two tests ensure:

Decision 1 evaluated TRUE (Test 1) and FALSE (Test 2)

Decision 2 evaluated at least once (receipt = YES in Test 1)

Thus, Test 1 and Test 2 form the minimal set for full decision coverage.

Other options:

C and D are redundant for the minimal set.

A includes an extra test not needed for minimal decision coverage.

Answer: B. Test 1, Test 2

This user story is about a logged-in user measuring their blood sugar using a connected glucose meter and seeing the result quickly. The acceptance criterion specifies that the result should be displayed in less than four seconds.

Option B is correct because:

It starts with a valid GIVEN precondition (“I am logged in”).

The WHEN step matches the functionality described in the user story (blood sugar measurement using a connected device).

The THEN step explicitly includes the performance expectation (“less than 4 seconds”), aligning directly with the acceptance criterion.

Other options:

A is incorrect — while it mentions the correct functionality, “I am diabetic” is not a necessary system precondition.

C refers to blood pressure instead of blood sugar — mismatched with the user story.

D introduces additional functionality (alerts for hypo-/hyperglycemia), which is not part of the specified acceptance criteria.

Answer: B. GIVEN I am logged in on the system … THEN I can see the result … in less than 4 second

In acceptance testing, close collaboration between testers and business analysts ensures that test results are properly interpreted and aligned with business expectations.

A. Testers verify the effectiveness of corrective actions and document their verdict in the defect report — Correct. When a defect is resolved, testers retest the system and record whether the issue is fixed. This is a common testing activity during acceptance test execution.

E. Business analysts compare the test execution result to the acceptance criteria of the requirement / user story — Correct. This ensures the functionality fulfills business needs and determines whether the criteria have been met for acceptance.

Incorrect options:

B: Testers do record actual results, but not necessarily "in a defect" unless a defect is found.

C: Priority is usually assigned by business analysts or stakeholders, not testers alone.

D: Business analysts do consider the impact of changes, but evaluating development risks is more a joint task with architects or developers.

Answer: A and E