ISTQB Risk-Based Testing Strategies 2 — Questions and Answers
Question 1: In risk-based testing, what does 'risk exposure' represent?
- The number of defects found during testing
- The product of likelihood and impact of a risk (Correct answer)
- The total testing effort allocated to high-risk areas
- The percentage of requirements covered by tests
Correct answer: The product of likelihood and impact of a risk
Risk exposure is calculated as the product of the probability (likelihood) that a risk will occur and the impact it would have if it did occur.
Question 2: Which activity is MOST closely associated with the 'risk identification' phase in risk-based testing?
- Executing test cases against high-risk components
- Brainstorming sessions with stakeholders to list potential risks (Correct answer)
- Prioritizing risks by their exposure level
- Monitoring residual risks after testing
Correct answer: Brainstorming sessions with stakeholders to list potential risks
Risk identification involves techniques like brainstorming, expert interviews, and checklists to enumerate potential product and project risks.
Question 3: A project team discovers a new critical defect late in the cycle affecting a medium-risk module. What should they do FIRST under a risk-based approach?
- Close the defect as out-of-scope since the module is only medium risk
- Re-assess the module's risk level given the new information (Correct answer)
- Proceed with the release since only high-risk modules block it
- Assign the defect to the next release without further action
Correct answer: Re-assess the module's risk level given the new information
Risk-based testing requires continuous risk re-assessment; a critical defect in a medium-risk module may elevate that module's risk level and change testing priorities.
Question 4: Which of the following BEST describes 'product risk' in the context of ISTQB risk-based testing?
- The risk that the project will exceed its budget
- The possibility that the software will fail to satisfy stakeholder needs (Correct answer)
- The risk that key team members will leave the project
- The risk of schedule slippage due to unclear requirements
Correct answer: The possibility that the software will fail to satisfy stakeholder needs
Product risk relates to potential quality problems in the software itself, such as failures that harm users or the business, as opposed to project risks which affect the project process.
Question 5: When using a risk matrix to prioritize testing, a feature is rated 'high likelihood' and 'low impact.' Where should testing effort be directed relative to a 'low likelihood, high impact' feature?
- More effort on the high likelihood/low impact feature
- Equal effort on both features
- More effort on the low likelihood/high impact feature (Correct answer)
- Neither feature requires significant testing effort
Correct answer: More effort on the low likelihood/high impact feature
Although both cells may yield similar risk exposure, high impact risks often receive more attention because their consequences are more severe if they occur.
Question 6: Which statement about risk-based test prioritization is CORRECT?
- Tests for low-risk areas are never executed in a risk-based approach
- Higher-risk test cases are run earlier so critical defects are found sooner (Correct answer)
- Risk-based prioritization applies only to system testing, not unit testing
- Prioritization is performed once at the start and never revisited
Correct answer: Higher-risk test cases are run earlier so critical defects are found sooner
Running higher-risk tests early ensures that the most critical defects are discovered while there is still time to fix them and re-test.
Question 7: What is the PRIMARY purpose of a 'risk register' in a testing project?
- To log all defects found during test execution
- To document identified risks, their assessments, and mitigation actions (Correct answer)
- To track the test execution progress by component
- To list all test cases with their pass/fail status
Correct answer: To document identified risks, their assessments, and mitigation actions
A risk register is a living document that captures each identified risk, its likelihood and impact ratings, owner, and planned mitigations or contingencies.
ISTQB Risk-Based Testing Strategies 2
In risk-based testing, what does 'risk exposure' represent?