ISTQB Risk-Based Testing Strategies 3 — Questions and Answers
Question 1: In risk-based testing, 'risk mitigation' through testing means:
- Eliminating all risks before the product is released
- Reducing risk likelihood or impact by finding and fixing defects (Correct answer)
- Transferring risk responsibility to the development team
- Accepting residual risks without further testing
Correct answer: Reducing risk likelihood or impact by finding and fixing defects
Testing mitigates risk by detecting defects early; fixing those defects reduces the likelihood or impact of failures occurring in production.
Question 2: Which factor is LEAST relevant when assessing the likelihood of a software risk?
- Complexity of the code being tested
- Experience of the developers writing the code
- Color scheme chosen for the user interface (Correct answer)
- Frequency with which the feature is used
Correct answer: Color scheme chosen for the user interface
UI color scheme has no bearing on the likelihood of a functional or technical risk materializing; complexity, developer experience, and usage frequency all influence likelihood.
Question 3: A test manager is asked to cut 30% of the test suite due to schedule pressure. How should a risk-based approach guide this decision?
- Remove tests randomly to be fair to all components
- Remove tests covering the highest-risk areas to save the most time
- Remove tests covering the lowest-risk areas to preserve coverage of critical functionality (Correct answer)
- Remove only automated tests since they can be re-run later
Correct answer: Remove tests covering the lowest-risk areas to preserve coverage of critical functionality
Risk-based testing calls for deprioritizing or removing tests on lower-risk areas first, ensuring the remaining effort is concentrated where failures would be most harmful.
Question 4: What does 'residual risk' mean after testing is completed?
- Risks that were eliminated by finding and fixing all defects
- The risk that remains after testing and mitigation activities have been applied (Correct answer)
- New risks introduced by changes made during testing
- Project risks unrelated to the software product
Correct answer: The risk that remains after testing and mitigation activities have been applied
Residual risk is the level of risk that persists after all planned testing and other mitigations have been performed; it is typically accepted by stakeholders before release.
Question 5: Which ISTQB document or artifact formally records the risk-based testing approach and how risks influence the testing strategy?
- Test summary report
- Test plan (Correct answer)
- Defect report
- Test case specification
Correct answer: Test plan
The test plan includes the risk-based testing approach, identifying how product risks drive test scope, priorities, effort allocation, and exit criteria.
Question 6: How does risk-based testing handle a situation where two features have equal risk exposure but very different impact scores?
- They are treated identically since their exposure is equal
- The feature with higher impact is typically tested more thoroughly due to potential consequence severity (Correct answer)
- The feature with lower impact always receives less testing effort
- Risk exposure is the only factor; impact scores are irrelevant once exposure is calculated
Correct answer: The feature with higher impact is typically tested more thoroughly due to potential consequence severity
When risk exposure is equal, testers often give priority to higher-impact risks because a failure there would cause more severe harm even though likelihood is lower.
Question 7: Which technique is commonly used during risk identification workshops to systematically elicit potential failure modes?
- Boundary value analysis
- Failure Mode and Effect Analysis (FMEA) (Correct answer)
- Equivalence partitioning
- Statement coverage analysis
Correct answer: Failure Mode and Effect Analysis (FMEA)
FMEA is a structured technique used to identify potential failure modes, their causes, and their effects, making it valuable for risk identification in testing.
ISTQB Risk-Based Testing Strategies 3
In risk-based testing, 'risk mitigation' through testing means: